Unauthenticated Admin Access in Uncanny Automator Pro Plugin

Executive Summary

The vulnerability in the Uncanny Automator Pro WordPress plugin (version 7.3.0.5 and earlier) was caused by a compromised vendor update server that distributed a malicious plugin build containing a backdoor.

This backdoor allows unauthenticated attackers to gain administrator access to affected WordPress sites by exploiting a "magic login" mechanism that uses hashed tokens derived from the site's authentication keys.

Additionally, the backdoor sends the site's secret keys and administrator details to attacker-controlled servers, enabling attackers to fully compromise the site.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can have severe impacts including unauthorized full administrator access to your WordPress site by attackers without any authentication.

Attackers can steal secret keys and administrator details, potentially leading to complete site takeover, data theft, and further malicious activities.

Even removing and reinstalling the plugin may not fully clean an infected site, meaning persistent compromise is possible.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by looking for indicators of compromise such as specific WordPress options and transient values, unauthenticated requests containing a specific query parameter, outbound connections to suspicious domains, and injected malicious code within the plugin files.

• Check for unusual query parameters in HTTP requests that may indicate exploitation attempts.
• Inspect the uncanny-automator-pro plugin files for injected backdoor code.
• Monitor outbound network connections from your WordPress site to detect communication with attacker-controlled servers.
• Examine WordPress options and transient values for unexpected or suspicious entries related to the plugin.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include updating the uncanny-automator-pro plugin to version 7.3.0.6 or later, which contains a clean build without the backdoor.

Note that simply removing and reinstalling the plugin may not fully clean an infected site, so additional cleanup and investigation may be necessary.

It is also recommended to review and reset any potentially compromised administrator credentials and secret keys.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthenticated attackers to gain administrator access to affected WordPress sites and exfiltrate secret keys and administrator details to attacker-controlled servers.

Such unauthorized access and data leakage can lead to violations of data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive information against unauthorized access and breaches.

Compromise of administrator credentials and secret keys increases the risk of further data breaches, potentially exposing personal data protected under these regulations.

Useful 0 Not Useful 0