Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Our work website is getting flooded with these types of hacks:
The files are getting uploaded throughout the entire site (not just the url shown in the picture). I our site is still up and running fine, as far as I can tell. How can I troubleshoot this vulnerability?
Old versions of Wordpress are known for some vulnerabilities inside them. Since a possible attacker might not know what installation you are running, but instead sees that you have got specific files available he might run some 'blind' attacks. This type of attack is often automated and run against multiple, possibly vulnerable, targets.
Please refer to http://www.cvedetails.com/vulnerability-list/vendor_id-2337/product_id-4096/Wordpress-Wordpress.html for some publicly known vulnerabilities in wordpress.
There is a specific exploit that seems to fit your situation on https://www.exploit-db.com . You might want to check it out here: https://www.exploit-db.com/exploits/3960/
EDIT: Arminius' comment is in fact correct and the here provided exploit might not fit perfectly. I assume that the OP's monitoring software generalizes the attack from "injection" to "file upload".
It looks like someone is trying to upload a file to your servers.The firewall is preventing this from actually happening -- but they shouldn't even be able to 'attempt' an upload, let alone get all the way to the point where it's just firewall that's blocking them.
My first advice would be to take a full back-up (files + DB) of your wordpress installation (if you haven't done so already), and keep the backup files somewhere other than this server.
Once you've safely backed up the files, look through your installation, specifically for files that have been modified recently, look at the entire wordpress folder structure (however deep it goes), because any .php file here will be executable. Look also for odd jpg/png/txt/gif/html files that might have be uploaded by attackers in the hopes of changing the extension to .php post-upload.
Although wordpress core has improved in security over the last couple years, their plugin ecosystem is still full of vulnerable code. My general rule is that the fewer plugins you have the better. So while your wordpress installation might be top-notch, a plugin somewhere might be giving them remote file upload capability, that they might have otherwise exploited were it not for the firewall.
Step 3, run a scan. One of my favorite tools is wp-scan It's a vulnerability scanner built specifically for wordpress, that scans your existing installation (including plugins and themes) and checks for known vulnerabilities across them all.
Step 4, update everything (if not done so already). Including Wordpress Core (which should update automatically). Run the scan after the updates to be sure.
The reason why you run a scan before updating, is that you might have a chance to detect the vulnerability pre-update, and that might give you an idea of what happened. If you update before scanning, the scan might turn up nothing.
In essence, the backup, inspect files, scan, update-and-rescan process should help ease some concerns you have.
