"Large-Scale Attack Targeting Tatsu Builder WordPress Plugin"
Security researchers have found that tens of thousands of WordPress websites are potentially at risk of compromise as part of an ongoing large-scale attack targeting a remote code execution vulnerability in the Tatsu Builder plugin. The vulnerability is tracked as CVE-2021-25094 (CVSS score of 8.1) and exists because one of the supported actions does not require authentication when uploading a zip file that is extracted under the WordPress upload directory. The researchers noted that while the plugin includes an extension control, this can be bypassed by adding a PHP shell with a filename that begins with a dot ("."). Furthermore, a race condition in the extraction process allows an attacker to call the shell file. The researchers stated that the security hole impacts both free and premium versions of Tatsu Builder, a proprietary plugin not available in the official WordPress repository but which is estimated to have between 20,000 and 50,000 installations. The researchers noted that although Tatsu sent an urgent email notification to its users in early April, at least a quarter of all installations are believed to still be vulnerable. Affecting all Tatsu Builder versions prior to 3.3.13, the vulnerability can be exploited by remote, unauthenticated attackers to execute code on vulnerable installations. The researchers stated that starting May 10, threat actors were observed probing WordPress websites in search of vulnerable iterations of the plugin, with the attacks reaching a peak of 5.9 million attempts per day on May 14. The adversaries would deploy a dropper capable of downloading malware to a randomly-named subfolder on vulnerable sites. The dropper is deployed as a hidden file. Tatsu Builder version 3.3.13 contains a full patch for the vulnerability (a partial fix was included in version 3.3.12), and users are advised to update to this version as soon as possible.
SecurityWeek reports: "Large-Scale Attack Targeting Tatsu Builder WordPress Plugin"