CVE-2023-6000 XSS Vulnerability Used to Target Over 3,000 Sites
A recent upswing in attacks originating from a new malware campaign is exploiting a well-known vulnerability in the WordPress plugin Popup Builder, affecting more than 3,300 websites through XSS attacks.
The Balada Injector campaign, identified in January, took advantage of a cross-site scripting (XSS) vulnerability labeled CVE-2023-6000, boasting a CVSS base score of 8.8.
Sucuri reports a noticeable uptick in attacks over the past three weeks from an ongoing malware campaign specifically targeting the Popup Builder vulnerability in versions 4.2.3 and earlier.
Sucuri's SiteCheck remote malware scanning has identified infections on over 1,170 websites. The domains associated with these attacks were registered on February 12th, 2024, less than a month ago, including ttincoming.traveltraffic[.]cc and host.cloudsonicwave[.]com.
Mode of Operation
Exploiting a known vulnerability in the Popup Builder WordPress plugin, attackers inject malicious code into the Custom JS or CSS section of the WordPress admin interface, stored in the wp_postmeta database table, as revealed by Sucuri to Cyber Security News.
These injections cover various Popup Builder events such as sgpb-ShouldOpen, sgpb-ShouldClose, sgpb-WillOpen, sgpbDidOpen, sgpbWillClose, sgpb-DidClose, corresponding to different stages in the popup display process on the official website.
Ways to Mitigate Impact of CVE-2023-6000
For mitigation, owners of unpatched Popup Builder plugins are advised to update the vulnerable plugin promptly or employ a web application firewall for virtual patching. The harmful injection can be removed via the Popup Builder's "Custom JS or CSS" section in the WordPress admin interface.
To prevent reinfection, thorough scanning at both the client and server levels is recommended to identify any hidden website backdoors, according to researchers. This recent malware campaign serves as a stark reminder of the risks associated with neglecting to maintain patched and updated website software.
