Critical vulnerability fixed in WordPress plugin with 800K installs

The NextGen Gallery development team has addressed two severe CSRF vulnerabilities to protect sites from potential takeover attacks.

NextGen Gallery, a WordPress plugin used for creating image galleries, currently has over 800,000 active installs, making this security update a top priority for all site owners that have it installed.

Backdoor injection and site takeover

The two NextGEN Gallery security vulnerabilities are rated as high and critical severity by Wordfence’s Threat Intelligence team who discovered them.

Both of them are Cross-Site Request Forgery (CSRF) bugs which, in the case of the critical vulnerability tracked as CVE-2020-35942, can lead to Reflected Cross-Site Scripting (XSS) and remote code execution (RCE) attacks via file upload or Local File Inclusion (LFI).

Attackers can exploit these security flaws by tricking WordPress admins into clicking specially crafted links or attachments to execute malicious code in their browsers.

Luckily, “[t]his attack would likely require some degree of social engineering, as an attacker would have to trick an administrator into clicking a link that submitted crafted requests to perform these actions,” Wordfence threat analyst Ram Gall said.

Following successful exploitation, the vulnerabilities can let hackers set up malicious redirects, inject spam, abuse compromised sites for phishing, and, ultimately, take over the sites completely.

As Gall further explains, “once an attacker achieves Remote Code Execution on a website, they have effectively taken over that site.”

However, XSS can also be used to take over sites if the attacker tricks logged-in admins to visit pages running malicious scripts or, as seen in attacks targeting XSS vulnerabilities, it can also be used to inject backdoors on compromised sites.

Over 530,000 sites still exposed to attacks

“We initially reached out to the plugin’s publisher, Imagely, the same day, and provided full disclosure the next day, on December 15, 2020,” Gall added.

“Imagely sent us patches for review on December 16, and published the patched version, 3.5.0, on December 17, 2020.”https://1bfff82c40eafc6571c06b6a010433d7.safeframe.googlesyndication.com/safeframe/1-0-37/html/container.html

While NextGEN Gallery was released in December, it only has just over 266,000 new downloads until yesterday according to raw download stats for the WordPress plugin’s repository, including both updates and new installs.

This translates into more than 530,000 WordPress sites with active NextGEN Gallery installations potentially exposed to takeover attacks if attackers start exploiting the two bugs.

Source: https://www.bleepingcomputer.com/news/security/critical-vulnerability-fixed-in-wordpress-plugin-with-800k-installs/?&web_view=true