Over 90 WordPress themes, plugins backdoored in provide chain assault

An enormous provide chain assault compromised 93 WordPress themes and plugins to include a backdoor, giving threat-actors full entry to web sites.

In whole, menace actors compromised 40 themes and 53 plugins belonging to AccessPress, a developer of WordPress add-ons utilized in over 360,000 lively web sites.

The assault was found by researchers at Jetpack, the creators of a safety and optimization instrument for WordPress websites, who found {that a} PHP backdoor had been added to the themes and plugins.

Jetpack believes an exterior menace actor breached the AccessPress web site to compromise the software program and infect additional WordPress websites.

A backdoor to offer full management

As quickly as admins put in a compromised AccessPress product on their web site, the actors added a brand new “preliminary.php” file into the principle theme listing and included it in the principle “features.php” file.

This file contained a base64 encoded payload that writes a webshell into the “./wp-includes/vars.php” file.

The malicious code accomplished the backdoor set up by decoding the payload and injecting it into the “vars.php” file, basically giving the menace actors distant management over the contaminated web site.

The one strategy to detect this menace is to make use of a core file integrity monitoring answer, because the malware deletes the “preliminary.php” file dropper to cowl its tracks.

Based on Sucuri researchers who investigated the case to determine the actors’ aim, menace actors used the backdoor to redirect guests to malware-dropping and rip-off websites. Due to this fact, the marketing campaign wasn’t very subtle.

It’s additionally attainable that the actor used this malware to promote entry to backdoored web sites on the darkish internet, which might be an efficient strategy to monetize such a large-scale an infection.

Am I affected?

When you have put in one of many compromised plugins or themes in your web site, eradicating/changing/updating them received’t uproot any webshells which will have been planted by means of it.

As such, web site directors are suggested to scan their websites for indicators of compromise by doing the next:

• Verify your wp-includes/vars.php file round strains 146-158. Should you see a “wp_is_mobile_fix” operate there with some obfuscated code, you’ve been compromised.
• Question your file system for “wp_is_mobile_fix” or “wp-theme-connect” to see if there are any affected recordsdata
• Change your core WordPress recordsdata with recent copies.
• Improve the affected plugins and swap to a distinct theme.
• Change the wp-admin and database passwords.

Jetpack has offered the next YARA rule that can be utilized to verify if a web site has been contaminated and detect each the dropper and the put in webshell.

rule accesspress_backdoor_infection
{
strings:
 
   // IoC's for the dropper
   $inject0 = "$fc = str_replace('operate wp_is_mobile()',"
   $inject1 = "$b64($b) . 'operate wp_is_mobile()',"
   $inject2 = "$fc);"
   $inject3 = "@file_put_contents($f, $fc);"
 
   // IoC's for the dumped payload
   $payload0 = "operate wp_is_mobile_fix()"
   $payload1 = "$is_wp_mobile = ($_SERVER['HTTP_USER_AGENT'] == 'wp_is_mobile');"
   $payload2 = "$g = $_COOKIE;"
   $payload3 = "(depend($g) == 8 && $is_wp_mobile) ?"
 
   $url0 = /https?://(www.)?wp-theme-connect.com(/photos/wp-theme.jpg)?/
 
situation:
 
   all of ( $inject* )
   or all of ( $payload* )
   or $url0
}

Backdoors detected in September

Jetpack first detected the backdoor in September 2021, and shortly after, the researchers found that menace actors had compromised all free plugins and themes belonging to the seller.

Jetpack believes that the paid AccessPress add-ons have been doubtless compromised however didn’t take a look at these, so this can’t be confirmed.

A lot of the merchandise had doubtless been compromised in early September from the timestamps.

On October 15, 2021, the seller eliminated the extensions from the official obtain portal till the purpose of the compromise was situated and glued.

On January 17, 2022, AccessPress launched new, “cleaned” variations for all of the affected plugins.

Nevertheless, the affected themes haven’t been cleaned but, so migrating to a distinct theme is the one strategy to mitigate the safety dangers.

Customers of AccessPress plugins and themes can learn Jetpack’s put up for a whole record of the fastened merchandise.

BleepingComputer tried to contact AccessPress concerning the compromise, however the contact kind just isn’t working.