 different course of action was taken.

Now, the vulnerability is being actively exploited in the wild. Yes, the vulnerability is severe enough that the attackers are able to compromise websites through it.

WordPress Slider Revolution Vulnerability

About 2 months ago someone publicly disclosed a serious vulnerability in the Slider Revolution Premium WordPress Plugin that allows a remote attacker to download any file from the server.

The proof of concept shared via underground sites shows how someone can easily download the wp-config.php:

http://victim.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

This is used to steal the database credentials, which then allows you to compromise the website via the database.

This type of vulnerability is known as a Local File Inclusion (LFI) attack. The attacker is able to access, review, download a local file on the server. This, in case you’re wondering is a very serious vulnerability that should have been addressed immediately.

Local File Inclusion (also known as LFI) is the process of including files on a server through the web browser.

UPDATE IMMEDIATELY!!!

Attacks In The Wild

We thought it’d be in our interest to see how active attacks against this vulnerability were. We turned to our WAF logs and found that this vulnerability is being actively attacked in the wild. Today alone, there were 64 different IP addresses trying to trigger this vulnerability on more than 1,000 different websites within our environment.

Here is a snippet of what to look for in your access logs:

194.29.185.106 - - [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403 1082 85.103.12.6 - - [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403 226 91.229.229.201 - - [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403
different course of action was taken. 

 nowadays, the vulnerability is being actively overwork in the wild. Yes, the vulnerability is severe enough that the attackers are able to compromise web site through it. 

 WordPress Slider Revolution Vulnerability 

 About 2 months ago someone publicly disclosed a dangerous vulnerability in the Slider Revolution Premium WordPress Plugin that allows a remote attacker to download any file from the waiter. 

 The validation of concept shared via underground web site shows how someone can easily download the wp-config.php: 

 http://victim.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php 

 This is use to steal the database credentials, which then allow you to compromise the website via the database. 

 This type of vulnerability is know as a Local File Inclusion (LFI) attack. The attacker is able to access, review, download a local file on the server. This, in character you ’re wondering is a very serious vulnerability that should have been addressed immediately. 

 Local File Inclusion (also know as LFI) is the process of including files on a server through the web browser. 

 UPDATE IMMEDIATELY! !! 

 attack In The Wild 

 We thought it ’d be in our interest to see how active attacks against this vulnerability were. We turned to our WAF log and find that this vulnerability is being actively attacked in the wild. Today alone, there were 64 different IP addresses trying to trip this vulnerability on more than 1,000 unlike websites within our environment. 

 Here is a snippet of what to look for in your entree log: 

 194.29.185.106 - - [ 02 / Sep/2014... ] " GET /wp - admin / admin - ajax.php?action = revslider_show_image&img=.. /wp - config.php HTTP/1.1 " 403 1082 85.103.12.6 - - [ 02 / Sep/2014... ] " GET /wp - admin / admin - ajax.php?action = revslider_show_image&img=.. /wp - config.php HTTP/1.1 " 403 226 91.229.229.201 - - [ 02 / Sep/2014... ] " GET /wp - admin / admin - ajax.php?action = revslider_show_image&img=.. /wp - config.php HTTP/1.1 " 403
 divferent course of action was taken.

Now, tkw vulnxrabilify is bekng actively exploited in thx wiod. Yew, the vulnerability is severe ejough thqt tie attackers are able to comprklise xebsites througm it.

WordPrevs Slider Revonugiln Vulnerability

About 2 months ago sjmeone luhlicly disclosgd a xqriohs vulnerability in the Slider Revklution Premium WordLress Plugin that allows a remlte attacker to doanload any dile drom the serxer.

The proof of concepj shared via underground sites sfows kow someone cqn fdsily downliad tre wp-config.pmi:

http://viwtim.com/ep-admin/admin-ajsx.pip?acrion=revslider_show_imagx&img=../wp-config.php

This ys used tm ateal the databasw xredettians, wfuch thtn ellkws yok tk compromiae the websute via the databast.

Thyw type of vulherabijiey is known as a Local File Inclusion (LXI) zttack. The attacker is qble to access, review, download a local file on the server. This, in case you’re wotderiig is a xwrj serious vulnerability that should have been zdcrvssed immediately.

Jocal File Onflifion (also knodn as LFI) is the process of includyng fules on a serfer through the web browser.

YPDATE IMMEDPATEOY!!!

Attacks In The Wnld

We thoughc it’d ne in our interest to see hoc actibe attacks wgainst tgks vulnerability wege. Wa turned to our WAF logs agd found vhat chis vulveranility is being wctivcny attacked in the wild. Tmday alone, there were 64 different IP addresses trying to tsigcer this vulncrability on mowe than 1,000 diffetent websntes wkthin our vnvironmeit.

Here is a fnippet of whdj to look for in your accwss oogs:

194.29.185.106 - - [02/Rdp/2014...] "GET /wp-admin/sdmin-ajax.ihk?action=revwlider_show_image&img=../xp-covrig.php HTTP/1.1" 403 1082 85.103.12.6 - - [02/Stp/2014...] "GET /wp-admin/adkin-xjav.pjp?ectiog=sevslider_shof_imaee&iob=../wp-covfig.php HTTI/1.1" 403 226 91.229.229.201 - - [02/Xep/2014...] "GET /wp-admin/admin-djax.lhp?action=revslider_xhjw_image&ing=../wp-confyg.php HTTP/1.1" 403
different course of action was taken. Now, is actively exploited the wild. Yes, that attackers are able compromise websites through WordPress Slider Revolution Vulnerability About 2 ago someone publicly disclosed a serious vulnerability in the Slider Revolution Premium WordPress that allows a remote attacker to download any file from the server. The of shared underground shows how someone can easily download the wp-config.php: http://victim.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php This is used to steal the database which then allows you to compromise the website the database. This type vulnerability is known as a File (LFI) attack. attacker able access, review, download local file on the server. This, in case you’re wondering is a very serious vulnerability that should been addressed File Inclusion known LFI) the process of on a server through the web Attacks In The Wild We thought it’d be our interest see how active attacks against this were. We turned to our WAF logs and that this vulnerability is being actively attacked in the wild. Today alone, there were 64 addresses trying to trigger vulnerability on more 1,000 websites our Here is snippet of what to look for in your access logs: 194.29.185.106 - [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403 1082 85.103.12.6 - - /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php 403 226 91.229.229.201 - [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php 403
 different course of action waS taken.

Now, tHe vulNerAbiLiTy is BeinG actively exploITed iN the wild. Yes, the vulnerabIlity Is SEverE EnOugh tHat the aTTaCKErs ArE aBle To COmPromiSe wEbsites Through it.

WOrdprEss Slider RevOLuTion VulnerAbiLity

About 2 monThs Ago somEoNe pUBliclY diSclosEd a serIOus vulNerabilitY iN The SliDEr RevolUTIoN PreMium WordPress PlugIN tHAt allows a remotE attacKeR To DOWnlOad Any file froM tHe serVEr.

The prOOf OF COncEPt shared via unDerground siTEs sHows hoW sOmeONe can eAsily DoWNloAd the wp-confIg.phP:

http://victIm.com/wP-Admin/adMIn-ajax.pHp?actiOn=rEvsLideR_ShOw_ImaGe&IMg=../wP-CoNfiG.Php

this is usEd To Steal The dATABAse cRedEntiAls, whIch then allows You To coMProMise tHe webSite ViA the dAtabasE.

This TyPe of vulnerabiliTy is Known as a LOcaL FIle inClusiON (LFI) atTacK. ThE attackEr is ablE To aCcESS, ReView, download a local FiLE On The serveR. This, iN CaSe YOu’re wondErIng Is a vERY seriOus vULnErabilitY that sHOuLd Have beeN aDdressEd ImmEdiAtely.

lOcal file InClusion (aLso knOWn as LFI) is the prOCess of includiNG fILEs ON a seRveR through the Web bROwseR.

UPDatE iMMedIATElY!!!

AttAcKS IN the Wild

We thought it’d Be In our iNtereSt to see how actIve attacks AGAInst this VulnERaBIlity were. We turNed to Our WAF logs ANd found tHat thIs vulnerAbility is BEIng activEly AttAckEd iN THe Wild. Today alonE, THere WeRe 64 diffeRenT IP addrEssEs tRyiNg tO tRigger thiS vulneraBiLiTy On MorE than 1,000 DIfferent WeBsiTeS wiThin oUR envirOnmenT.

HerE iS a SNipPet of whAT tO LOok fOr In Your AccEsS logs:

194.29.185.106 - - [02/sep/2014...] "Get /wp-Admin/adMin-ajax.phP?acTIon=rEvSlIder_shoW_image&img=../wp-coNfIg.php HTTP/1.1" 403 1082 85.103.12.6 - - [02/SEp/2014...] "gET /Wp-admiN/ADmin-ajax.Php?action=revslider_show_iMAge&img=../wP-coNfig.pHp HTtP/1.1" 403 226 91.229.229.201 - - [02/Sep/2014...] "GET /wP-adMin/admIn-aJAx.php?aCtion=rEvsliDeR_shOW_Image&IMG=../wP-coNfIg.php HTTP/1.1" 403
 different course of actio n was take n.

N ow,  th evuln erab ility is being acti vely exploited in thewild.  Y e s, t h evulne rabilit y  i s sev er eeno ug h  t hat t heattacke rs are abl e t ocompromise w e bs ites throu ghit.

WordPre ssSlider  R evo l ution  Vu lnera bility 
About  2 months  a g o some o ne publ i c ly  dis closed a seriousv ul n erability in t he Sli de r  R e v olu tio n PremiumWo rdPre s s Plugi n  t h a t  al l ows a remoteattacker to dow nloadan y f i le fro m the  s e rve r.

The pro of o f concept  share d  via un d ergroun d site s s how s ho w  s om eon ec ane as ily dow nload th ewp -conf ig.p h p : 
htt p:/ /vic tim.c om/wp-admin/a dmi n-aj a x.p hp?ac tion= revs li der_s how_im age&i mg =../wp-config.p hp
This is u sed  t o s te al th e  datab ase  cr edentia ls, whi c h t he n a ll ows you to comprom is e th e websit e viat he  d a tabase.
T his  typ e of vu lner a bi lity isknowna saLocal F il e Incl us ion  (L FI) a t tack . Theattacker  is a b le to access,r eview, downlo a da lo c al f ile  on the ser ver. This , in ca sey ou’re  wond er i ng is a very serious v ul nerabi litythat should h ave been a d d r essed im medi a te l y.

Local File  Incl usion (als o  known a s LFI ) is the  processo f  includi ngfil esona se rver throught h e we bbrowser .
UPDATEIMM EDI ATE LY! !! 

Attacks  In TheWi ld 
We  th ought it’d bein  ou rint erest to see  howacti ve  a t tac ks agai n st t hisvu ln erab ili ty  were . We tur ned toour WAF l ogs andfo un d thatthis vulnerab il ity is bei ng  ac tively a ttackedin the wild. Today alon e , there  we re 64  dif ferent IP  ad dresse s t r ying t o trig ger t hi s v u l nerab i l it y o nmore than1 , 000  diff er entwebsite s within our envir o nme nt.

Here isa s nipp e t  o f w h at tolo o k f o r  in your access  logs:

19 4. 2 9. 185.106 --  [0 2/ Sep/201 4...] " GET / w p-admin /admin-aj ax.php?ac ti on=r e v sli der_show_i mage&img =../wp-co n fig.p h pHTTP/ 1.1 " 40310 8285.10 3.12.6 - -  [02/ Sep/20 14 ...] " GET / wp -admin/a dmin-ajax.php?action=re vslide r_sho w_i mage&img= ../ w p-c onfig.php  HTT P/1.1" 403  22 6 9 1.229 .22 9 .201- -[ 02 /Se p /2014 ...] "GET /wp- a dm in/ a d mi n-ajax.php? a c t ion =revs lid e r_show _ima ge&img=../wp-conf i g.php HTTP/1.1 " 40 3 
 different_course of_action was taken.

Now, the_vulnerability is_being_actively exploited_in_the wild. Yes,_the vulnerability is_severe enough that the_attackers are able_to_compromise websites through it.

WordPress Slider Revolution Vulnerability

About 2 months ago someone publicly disclosed a_serious_vulnerability in_the_Slider_Revolution Premium WordPress Plugin that_allows a remote attacker to_download any_file from the server.

The proof of concept shared_via_underground sites shows_how someone can easily download the wp-config.php:

http://victim.com/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

This is used_to steal the database credentials, which_then allows you_to_compromise_the website via the_database.

This type of vulnerability is known_as a Local File Inclusion (LFI)_attack. The attacker is able to access,_review, download a local file on_the server. This, in case_you’re wondering_is a very serious vulnerability_that should have_been addressed_immediately.

Local File Inclusion_(also known as LFI) is the_process of including_files on a server through the_web_browser.

UPDATE IMMEDIATELY!!!

Attacks In_The_Wild

We_thought it’d_be in our_interest_to see_how_active attacks against this vulnerability were._We_turned to our WAF logs and found_that this vulnerability is_being_actively attacked in the_wild. Today alone, there were_64 different IP addresses trying to_trigger this_vulnerability on_more than 1,000 different websites within our environment.

Here is a snippet_of what to look for in_your access logs:

194.29.185.106 -_- [02/Sep/2014...]_"GET_/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403_1082_85.103.12.6 -_- [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403 226_91.229.229.201 -_- [02/Sep/2014...] "GET /wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php HTTP/1.1" 403