0

Our work website is getting flooded with these types of hacks:

enter image description here

The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running fine, as far as I can tell. How can I troubleshoot this vulnerability?

  • 2
    What makes you think you're vulnerable? – Stephane May 24 '17 at 14:40
  • It says they were blocked for "malicious file upload". Doesn't that mean they were able to upload a file? If so, then how were they able to do it? We don't have any upload feature on our site. – Lumo5 May 24 '17 at 14:47
  • 5
    @Lumo5 No, it just means that this firewall detected a pattern of an attempt to upload a malicious file - not that there is a successful attack going on. – Arminius May 24 '17 at 14:53
  • @Lumo5 not "hacks", you are getting flooded with "alerts". They are being blocked. – schroeder May 24 '17 at 15:08
  • 1
    If there is a vulnerability in your software that allows you to upload a file (even if the software is not intended to upload something) - then an attacker might want to exploit this vulnerability. – anon May 24 '17 at 15:22
1

Old versions of Wordpress are known for some vulnerabilities inside them. Since a possible attacker might not know what installation you are running, but instead sees that you have got specific files available he might run some 'blind' attacks. This type of attack is often automated and run against multiple, possibly vulnerable, targets.

Please refer to http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html for some publicly known vulnerabilities in wordpress.

There is a specific exploit that seems to fit your situation on https://www.exploit-db.com . You might want to check it out here: https://www.exploit-db.com/exploits/3960/

EDIT: Arminius' comment is in fact correct and the here provided exploit might not fit perfectly. I assume that the OP's monitoring software generalizes the attack from "injection" to "file upload".

  • But your linked exploit is not related to file uploads which OP's attack apparently is, – Arminius May 24 '17 at 14:58
  • Well the OP's monitoring system assumes that there is a file upload by some found patterns. I by myself assume that it might be generalized from "injection" to "upload". – anon May 24 '17 at 15:02
  • So, it is possible that my security software sees a SQL injection and refers to it as a file upload? – Lumo5 May 24 '17 at 15:16
  • @Lumo5 You have to dive deeper in more detailed logs or ask the vendor of your security software if that is possible. – anon May 24 '17 at 15:23
0

It looks like someone is trying to upload a file to your servers.The firewall is preventing this from actually happening -- but they shouldn't even be able to 'attempt' an upload, let alone get all the way to the point where it's just firewall that's blocking them.

My first advice would be to take a full back-up (files + DB) of your wordpress installation (if you haven't done so already), and keep the backup files somewhere other than this server.

Once you've safely backed up the files, look through your installation, specifically for files that have been modified recently, look at the entire wordpress folder structure (however deep it goes), because any .php file here will be executable. Look also for odd jpg/png/txt/gif/html files that might have be uploaded by attackers in the hopes of changing the extension to .php post-upload.

Although wordpress core has improved in security over the last couple years, their plugin ecosystem is still full of vulnerable code. My general rule is that the fewer plugins you have the better. So while your wordpress installation might be top-notch, a plugin somewhere might be giving them remote file upload capability, that they might have otherwise exploited were it not for the firewall.

Step 3, run a scan. One of my favorite tools is wp-scan It's a vulnerability scanner built specifically for wordpress, that scans your existing installation (including plugins and themes) and checks for known vulnerabilities across them all.

Step 4, update everything (if not done so already). Including Wordpress Core (which should update automatically). Run the scan after the updates to be sure.

The reason why you run a scan before updating, is that you might have a chance to detect the vulnerability pre-update, and that might give you an idea of what happened. If you update before scanning, the scan might turn up nothing.

In essence, the backup, inspect files, scan, update-and-rescan process should help ease some concerns you have.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.