{"id":399,"date":"2026-08-09T10:40:25","date_gmt":"2026-08-09T08:40:25","guid":{"rendered":"https:\/\/helloblog.io\/hu\/bdthemes-ellatasi-lanc-tamadas-ioc-teendok\/"},"modified":"2026-08-09T10:40:25","modified_gmt":"2026-08-09T08:40:25","slug":"bdthemes-ellatasi-lanc-tamadas-ioc-teendok","status":"publish","type":"post","link":"https:\/\/helloblog.io\/hu\/bdthemes-ellatasi-lanc-tamadas-ioc-teendok\/","title":{"rendered":"BdThemes ell\u00e1t\u00e1sil\u00e1nc-t\u00e1mad\u00e1s: m\u00e9rgezett API-v\u00e1laszokon \u00e1t fert\u0151ztek WordPress-oldalakat"},"content":{"rendered":"\n<p>A BdThemes t\u00f6bb, a hivatalos WordPress-b\u0151v\u00edtm\u00e9nyt\u00e1rban el\u00e9rhet\u0151 b\u0151v\u00edtm\u00e9ny\u00e9t \u00e9rint\u0151 ell\u00e1t\u00e1sil\u00e1nc-t\u00e1mad\u00e1s t\u00f6rt\u00e9nt. A t\u00e1mad\u00f3knak nem kellett m\u00f3dos\u00edtaniuk a WordPress.org-on t\u00e1rolt forr\u00e1sk\u00f3dot: egy t\u00e1voli, prom\u00f3ci\u00f3s adminisztr\u00e1ci\u00f3s bannerekhez haszn\u00e1lt JSON-adatfolyamot m\u00e9rgeztek meg, majd azon kereszt\u00fcl futtattak k\u00f3dot a bejelentkezett adminisztr\u00e1torok b\u00f6ng\u00e9sz\u0151j\u00e9ben.<\/p>\n\n\n\n<p>Az \u00e9rintett b\u0151v\u00edtm\u00e9nyeket 2026. augusztus 7-\u00e9n ideiglenesen bez\u00e1rt\u00e1k a WordPress-b\u0151v\u00edtm\u00e9nyt\u00e1rban a teljes \u00e1tvizsg\u00e1l\u00e1s idej\u00e9re. Ha BdThemes-b\u0151v\u00edtm\u00e9nyt haszn\u00e1lsz, ne el\u00e9gedj meg a f\u00e1jlintegrit\u00e1s ellen\u0151rz\u00e9s\u00e9vel: vizsg\u00e1ld \u00e1t a felhaszn\u00e1l\u00f3kat, a b\u0151v\u00edtm\u00e9nyk\u00f6nyvt\u00e1rakat \u00e9s az adatb\u00e1zis opci\u00f3s t\u00e1bl\u00e1j\u00e1t is.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">Mi\u00e9rt k\u00fcl\u00f6n\u00f6sen vesz\u00e9lyes?<\/h4>\n\n\n<p>A t\u00e1mad\u00e1s sikeres lefut\u00e1sakor illet\u00e9ktelen adminisztr\u00e1tori fi\u00f3k, webshell \u00e9s Must-Use (MU) b\u0151v\u00edtm\u00e9nyk\u00e9nt m\u0171k\u00f6d\u0151 perzisztens h\u00e1ts\u00f3 kapu ker\u00fclhet a webhelyre. A b\u0151v\u00edtm\u00e9nyf\u00e1jlok v\u00e1ltozatlanok maradhatnak, ez\u00e9rt a kiz\u00e1r\u00f3lag f\u00e1jlm\u00f3dos\u00edt\u00e1sokra \u00e9p\u00edt\u0151 ellen\u0151rz\u00e9sek nem felt\u00e9tlen\u00fcl jeleznek.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">Az \u00e9rintett b\u0151v\u00edtm\u00e9nyek \u00e9s a sebezhet\u0151s\u00e9g<\/h2>\n\n\n\n<p>A probl\u00e9ma a BdThemes-b\u0151v\u00edtm\u00e9nyekben tal\u00e1lhat\u00f3 <strong>Biggopti<\/strong> komponenshez k\u00f6t\u0151dik. Ez a rendszer adminisztr\u00e1ci\u00f3s prom\u00f3ci\u00f3s bannereket k\u00e9r le a szolg\u00e1ltat\u00f3 API-j\u00e1r\u00f3l, majd a WordPress vez\u00e9rl\u0151pultj\u00e1n megjelen\u00edti \u0151ket. A h\u00e1tt\u00e9r nem dinamikus alkalmaz\u00e1sszerver volt, hanem Cloudflare-rel v\u00e9dett DigitalOcean Spaces objektumt\u00e1rol\u00f3b\u00f3l kiszolg\u00e1lt statikus JSON-f\u00e1jlok gy\u0171jtem\u00e9nye.<\/p>\n\n\n\n<p>A Biggopti k\u00fcl\u00f6nb\u00f6z\u0151 verzi\u00f3it egy k\u00f6zepes s\u00falyoss\u00e1g\u00fa, <strong>CVSS 5.4-es<\/strong>, jav\u00edt\u00e1s n\u00e9lk\u00fcli XSS-sebezhet\u0151s\u00e9g \u00e9rinti. A hiba a Sigmative API-b\u00f3l \u00e9rkez\u0151 <code>display_id<\/code> mez\u0151 nem megfelel\u0151 kimeneti escape-el\u00e9s\u00e9b\u0151l ered. Aki \u00edrni tud a Sigmative API m\u00f6g\u00f6tti t\u00e1rhelyre, tetsz\u0151leges webes scriptet helyezhet el olyan oldalakon, amelyeket k\u00e9s\u0151bb egy felhaszn\u00e1l\u00f3 megnyit.<\/p>\n\n\n\n<p>Az \u00e9rintett b\u0151v\u00edtm\u00e9nyek:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Element Pack Addons for Elementor (<code>bdthemes-element-pack-lite<\/code>)<\/li>\n\n\n<li>Prime Slider Addons for Elementor (<code>bdthemes-prime-slider-lite<\/code>)<\/li>\n\n\n<li>Pixel Gallery Addons for Elementor (<code>pixel-gallery<\/code>)<\/li>\n\n\n<li>Ultimate Post Kit Addons for Elementor (<code>ultimate-post-kit<\/code>)<\/li>\n\n\n<li>Ultimate Store Kit \u2013 Addon For WooCommerce, EDD and Elementor (<code>ultimate-store-kit<\/code>)<\/li>\n\n\n<li>Live Copy Paste for Elementor (<code>live-copy-paste<\/code>)<\/li>\n\n\n<li>Smart Admin Assistant (<code>smart-admin-assistant<\/code>)<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">\u00cdgy v\u00e1lt a prom\u00f3ci\u00f3s feed t\u00e1mad\u00e1si fel\u00fclett\u00e9<\/h2>\n\n\n\n<p>Minden Biggopti-t haszn\u00e1l\u00f3 \u00e9rintett b\u0151v\u00edtm\u00e9ny az <code>admin_init<\/code> hookon bet\u00f6lt egy kliensoldali JavaScript-f\u00e1jlt. Emiatt a script felt\u00e9tel n\u00e9lk\u00fcl lefut minden egyes <code>wp-admin<\/code> oldallet\u00f6lt\u00e9skor, lek\u00e9ri a banneradatokat a gy\u00e1rt\u00f3 API-endpointj\u00e1r\u00f3l, majd \u00f6ssze\u00e1ll\u00edtja a megjelen\u00edt\u00e9shez sz\u00fcks\u00e9ges DOM-elemeket.<\/p>\n\n\n\n<p>A gondot az okozza, hogy a script a t\u00e1voli JSON <code>display_id<\/code> \u00e9rt\u00e9k\u00e9t k\u00f6zvetlen\u00fcl f\u0171zi bele egy HTML <code>id<\/code> attrib\u00fatumba, kliensoldali escape-el\u00e9s n\u00e9lk\u00fcl. A sebezhet\u0151 logika l\u00e9nyeg\u00e9ben \u00edgy m\u0171k\u00f6dik:<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ A t\u00e1voli JSON-b\u00f3l \u00e9rkez\u0151 \u00e9rt\u00e9k nincs escape-elve.\nvar displayId = data.display_id || data.id || &quot;default&quot;;\nvar elementId = &quot;bdt-admin-biggopti-api-biggopti-&quot; + displayId;\nhtml = 'id=&quot;' + elementId + '&quot;';\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ A t\u00e1voli JSON-b\u00f3l \u00e9rkez\u0151 \u00e9rt\u00e9k nincs escape-elve.<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> displayId <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> data.display_id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#E1E4E8\"> data.id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"default\"<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> elementId <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> \"bdt-admin-biggopti-api-biggopti-\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> displayId;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">html <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> 'id=\"'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> elementId <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> '\"'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Ugyanebben a k\u00f3dban a <code>data-display-id<\/code> attrib\u00fatumhoz m\u00e1r escape-elnek speci\u00e1lis karaktereket: az <code>&amp;<\/code>, <code>&lt;<\/code>, <code>&gt;<\/code>, illetve id\u00e9z\u0151jelek HTML-entit\u00e1sra cser\u00e9l\u0151dnek. Ez azonban nem v\u00e9di az <code>id<\/code> attrib\u00fatumba ker\u00fcl\u0151 \u00e9rt\u00e9ket, ahol a hiba megmaradt.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function escapeAttribute(value) {\n  return (value || &quot;&quot;)\n    .replace(\/&amp;\/g, &quot;&amp;amp;&quot;)\n    .replace(\/&lt;\/g, &quot;&amp;lt;&quot;)\n    .replace(\/&gt;\/g, &quot;&amp;gt;&quot;)\n    .replace(\/&quot;\/g, &quot;&amp;quot;&quot;);\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> escapeAttribute<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#FFAB70\">value<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> (value <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x26;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;amp;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x3C;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;lt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">><\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;gt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">\"<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;quot;\"<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>A nem escape-elt attrib\u00fatum-injekt\u00e1l\u00e1s 2026. m\u00e1rcius 1-j\u00e9n ker\u00fclt be a Prime Slider 4.1.9-es verzi\u00f3j\u00e1ba, majd m\u00e1s b\u0151v\u00edtm\u00e9nyekbe is \u00e1tker\u00fclt. A k\u00e9s\u0151bbi kiad\u00e1sok a banner <code>content<\/code> mez\u0151j\u00e9hez <code>DOMParser<\/code>-alap\u00fa tiszt\u00edt\u00e1st vezettek be, amely elt\u00e1vol\u00edtotta a vesz\u00e9lyes HTML-tageket \u00e9s inline handlereket, de az <code>id<\/code> attrib\u00fatum hib\u00e1j\u00e1t nem jav\u00edtott\u00e1k.<\/p>\n\n\n\n<p>A t\u00e1mad\u00f3 a t\u00e1rol\u00f3hoz szerzett \u00edr\u00e1si jogosults\u00e1ggal a szab\u00e1lyos JSON-v\u00e1laszokat manipul\u00e1lt rekordokra cser\u00e9lte. A rosszindulat\u00fa <code>display_id<\/code> kit\u00f6rt az <code>id<\/code> attrib\u00fatumb\u00f3l, majd egy CSS-anim\u00e1ci\u00f3 indul\u00e1s\u00e1hoz k\u00f6t\u00f6tt <code>onanimationstart<\/code> esem\u00e9nykezel\u0151t sz\u00fart be. Ez k\u00f6r\u00fclbel\u00fcl 10 ezredm\u00e1sodpercen bel\u00fcl, csendben aktiv\u00e1l\u00f3dott, amikor egy adminisztr\u00e1tor b\u00e1rmelyik vez\u00e9rl\u0151pultoldalt bet\u00f6lt\u00f6tte.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A fert\u0151z\u00e9si folyamat t\u00f6bb payloadot haszn\u00e1l<\/h2>\n\n\n\n<p>Az injekt\u00e1lt esem\u00e9nykezel\u0151 k\u00fcls\u0151 scripteket t\u00f6lt\u00f6tt be. A t\u00e1mad\u00e1s t\u00f6bb l\u00e9pcs\u0151ben \u00e9s k\u00e9t elt\u00e9r\u0151 payload \u00fatj\u00e1n dolgozott, att\u00f3l f\u00fcgg\u0151en, hogy az adott b\u0151v\u00edtm\u00e9ny melyik API-endpointot haszn\u00e1lta.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Els\u0151dleges payload: <code>w2.js<\/code><\/h3>\n\n\n\n<p>Az <code>api-data-all-records<\/code> endpointot haszn\u00e1l\u00f3 b\u0151v\u00edtm\u00e9nyek eset\u00e9n a f\u0151 payload a <code>w2.js<\/code> volt. Ez a bejelentkezett adminisztr\u00e1tor munkamenet\u00e9ben futott, \u00e9s az al\u00e1bbi l\u00e9p\u00e9seket hajtotta v\u00e9gre:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>C2-ellen\u0151rz\u00e9s:<\/strong> a fert\u0151z\u00f6tt webhely origin \u00e9rt\u00e9k\u00e9vel kapcsolatba l\u00e9pett az <code>ia-cdn[.]com\/fz\/c<\/code> C2-endpointtal. Ha a v\u00e1lasz <code>skip<\/code> vagy <code>done<\/code> \u00e1llapotot adott, le\u00e1llt.<\/li>\n\n\n<li><strong>Illet\u00e9ktelen adminfi\u00f3k l\u00e9trehoz\u00e1sa:<\/strong> az akt\u00edv adminisztr\u00e1tori munkamenetben el\u00e9rhet\u0151 <code>X-WP-Nonce<\/code> seg\u00edts\u00e9g\u00e9vel a WordPress REST API-n kereszt\u00fcl pr\u00f3b\u00e1lt \u00faj adminisztr\u00e1tort felvenni. Sikertelens\u00e9gkor a hagyom\u00e1nyos \u0171rlapbek\u00fcld\u00e9sre \u00e1llt \u00e1t.<\/li>\n\n\n<li><strong>Webshell telep\u00edt\u00e9se:<\/strong> a C2-szerverr\u0151l let\u00f6lt\u00f6tt egy hamis b\u0151v\u00edtm\u00e9ny-ZIP-et, majd a szok\u00e1sos b\u0151v\u00edtm\u00e9nyfelt\u00f6lt\u0151 \u0171rlapon telep\u00edtette. A csomag semlegesnek t\u0171n\u0151 slugot kapott, p\u00e9ld\u00e1ul <code>wp-smart-thumbnails<\/code> nevet, \u00e9s egy k\u00f6zvetlen URL-lel h\u00edvhat\u00f3 <code>emer-run.php<\/code> webshellt tartalmazott.<\/li>\n\n\n<li><strong>MU-b\u0151v\u00edtm\u00e9nyes perzisztencia:<\/strong> az <code>emer-run.php<\/code> k\u00e9t modult telep\u00edtett a Must-Use b\u0151v\u00edtm\u00e9nyek k\u00f6nyvt\u00e1r\u00e1ba. A mint\u00e1k f\u00e1jlrendszer-id\u0151b\u00e9lyegeit 2025 szeptember\u00e9re \u00e1ll\u00edtott\u00e1k vissza, hogy beleolvadjanak a k\u00f6rnyezetbe; a f\u00e1jlnevek fert\u0151z\u00e9senk\u00e9nt v\u00e1ltozhatnak. Az egyik modul URL-param\u00e9terrel (<code>?_wplogin=&lt;token&gt;<\/code>) jelsz\u00f3 n\u00e9lk\u00fcli admin bel\u00e9p\u00e9st tett lehet\u0151v\u00e9, \u00e9s a legr\u00e9gebben regisztr\u00e1lt adminfi\u00f3kot c\u00e9lozta. A m\u00e1sik modul WordPress-adatb\u00e1zis-lek\u00e9rdez\u00e9sekbe hookolva elrejtette a l\u00e9trehozott fi\u00f3kokat az admin felhaszn\u00e1l\u00f3list\u00e1j\u00e1b\u00f3l, \u00e9s a felhaszn\u00e1l\u00f3k \u00f6sszes\u00edtett sz\u00e1m\u00e1t is ennek megfelel\u0151en cs\u00f6kkentette.<\/li>\n\n\n<li><strong>Adatsziv\u00e1rogtat\u00e1s:<\/strong> minden v\u00e9grehajt\u00e1si f\u00e1zis eredm\u00e9ny\u00e9t a <code>navigator.sendBeacon<\/code> API-val k\u00fcldte vissza a C2-szervernek.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">M\u00e1sodlagos payload: <code>x.js<\/code><\/h3>\n\n\n\n<p>Az <code>api-data-records<\/code> endpointot haszn\u00e1l\u00f3 \u00e1ldozatok a BdThemes infrastrukt\u00far\u00e1j\u00e1n t\u00e1rolt <code>x.js<\/code> scriptet kapt\u00e1k. Ez a webhely hostname-j\u00e9b\u0151l sz\u00e1m\u00edtott, determinisztikus adminisztr\u00e1tori hiteles\u00edt\u0151 adatokat gener\u00e1lt: a felhaszn\u00e1l\u00f3n\u00e9v <code>bd_<\/code> el\u0151tagot \u00e9s egy hat karakteres base36 hash-t kapott, a jelsz\u00f3 pedig <code>Bd@26!<\/code> el\u0151tagb\u00f3l, ugyanebb\u0151l a hash-b\u0151l \u00e9s egy <code>x<\/code> ut\u00f3tagb\u00f3l \u00e1llt.<\/p>\n\n\n\n<p>A hash a hostname karakterk\u00f3djait haszn\u00e1l\u00f3 egyszer\u0171 matematikai sz\u00e1m\u00edt\u00e1sb\u00f3l k\u00e9sz\u00fclt. Emiatt a t\u00e1mad\u00f3knak nem kellett k\u00f6zpontilag t\u00e1rolniuk a felt\u00f6rt oldalak list\u00e1j\u00e1t: egy gyan\u00fas domain alapj\u00e1n k\u00e9s\u0151bb is kisz\u00e1m\u00edthatt\u00e1k a v\u00e1rhat\u00f3 felhaszn\u00e1l\u00f3nevet \u00e9s jelsz\u00f3t. A fi\u00f3khoz <code>@wordpress.org<\/code> v\u00e9gz\u0151d\u00e9s\u0171 e-mail-c\u00edmet rendeltek.<\/p>\n\n\n\n<p>A script a gener\u00e1lt adatokkal a <code>\/wp-admin\/user-new.php<\/code> oldalon pr\u00f3b\u00e1lt adminfi\u00f3kot l\u00e9trehozni, a m\u0171velet kimenetel\u00e9t pedig elk\u00fcldte a C2-nek. Sikeres vagy m\u00e1r teljes\u00edtett fert\u0151z\u00e9s ut\u00e1n lehet\u0151s\u00e9g szerint <code>localStorage<\/code> jelz\u0151t mentett a b\u00f6ng\u00e9sz\u0151be, hogy ugyanabban a b\u00f6ng\u00e9sz\u0151ben ne futtassa le \u00fajra a folyamatot.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hat\u00f3k\u00f6r \u00e9s a t\u00e1mad\u00f3i infrastrukt\u00fara<\/h2>\n\n\n\n<p>A C2-domain ugyanahhoz a t\u00e1mad\u00f3i k\u00f6rh\u00f6z k\u00f6thet\u0151, amely az el\u0151z\u0151 k\u00e9t h\u00f3napban az Advanced Responsive Video Embedder \u00e9s az OptinMonster ell\u00e1t\u00e1sil\u00e1nc-t\u00e1mad\u00e1sait is v\u00e9grehajtotta. A kamp\u00e1ny c\u00e9lja a sz\u00e9les k\u00f6r\u0171, rejtett adminisztr\u00e1tori hozz\u00e1f\u00e9r\u00e9s fenntart\u00e1sa \u00e9s a t\u00e1voli k\u00f3dfuttat\u00e1s volt WordPress-k\u00f6rnyezetekben.<\/p>\n\n\n\n<p>Ebben az esetben nem a c\u00e9lwebhelyekhez kellett hozz\u00e1f\u00e9r\u00e9st szerezni. El\u00e9g volt a gy\u00e1rt\u00f3 prom\u00f3ci\u00f3s adatcsatorn\u00e1j\u00e1t kompromitt\u00e1lni, majd a megb\u00edzhat\u00f3nak tekintett adminisztr\u00e1ci\u00f3s bannerb\u0151l k\u00e1rtev\u0151terjeszt\u00e9si csatorn\u00e1t csin\u00e1lni. Az, hogy a rosszindulat\u00fa JSON-rekordok \u00e9s a m\u00e1sodlagos <code>x.js<\/code> payload is k\u00f6zvetlen\u00fcl a gy\u00e1rt\u00f3 t\u00e1rhely\u00e9re ker\u00fclt, a BdThemes felh\u0151t\u00e1rol\u00f3-hiteles\u00edt\u0151 adatainak vagy bels\u0151 infrastrukt\u00far\u00e1j\u00e1nak s\u00falyos kompromitt\u00e1l\u00e1s\u00e1ra utal.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Kompromitt\u00e1l\u00f3d\u00e1sra utal\u00f3 jelek<\/h2>\n\n\n\n<p>Ellen\u0151rizd az al\u00e1bbi k\u00fcls\u0151 er\u0151forr\u00e1sokat, f\u00e1jlokat, adatb\u00e1zis-bejegyz\u00e9seket \u00e9s felhaszn\u00e1l\u00f3i mint\u00e1kat. A m\u00e9rgezett gy\u00e1rt\u00f3i API-endpointok 2026. augusztus 8-\u00e1ra m\u00e1r tiszta JSON-t adtak vissza, de a kor\u00e1bban fert\u0151z\u00f6tt webhelyeken a perzisztens elemek ett\u0151l m\u00e9g megmaradhattak.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">K\u00fcls\u0151 URL-ek<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Els\u0151dleges payload: <code>ia-cdn[.]com\/fz\/w2.js<\/code><\/li>\n\n\n<li>C2 beacon endpoint: <code>ia-cdn[.]com\/fz\/c<\/code><\/li>\n\n\n<li>Kor\u00e1bban m\u00e9rgezett API: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-all-records<\/code><\/li>\n\n\n<li>Kor\u00e1bban m\u00e9rgezett API: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-records<\/code><\/li>\n\n\n<li>Kor\u00e1bban m\u00e9rgezett m\u00e1sodlagos script: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/x.js<\/code><\/li>\n\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">F\u00e1jlrendszer \u00e9s adatb\u00e1zis<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Webshell: <code>emer-run.php<\/code> &#8211; MD5: <code>1024732009983dd5e54b4cf5593f04d4<\/code><\/li>\n\n\n<li>MU-b\u0151v\u00edtm\u00e9nyes magic-login h\u00e1ts\u00f3 kapu: <code>class-wp-token-validate.php<\/code> &#8211; MD5: <code>7719cd98a35ffad2771f26d1ceab7d27<\/code><\/li>\n\n\n<li>MU-b\u0151v\u00edtm\u00e9nyes rejt\u0151zk\u00f6d\u0151 modul: <code>class-wp-query-9d127ff3.php<\/code>, illetve hasonl\u00f3 <code>class-wp-query-*.php<\/code> n\u00e9v &#8211; MD5: <code>9aadc3e5c5242b273bd17c5bdc358845<\/code><\/li>\n\n\n<li>MU-b\u0151v\u00edtm\u00e9nyes \u201eHealth Check\u201d modul: <code>wp-cache-optimizer.php<\/code> &#8211; MD5: <code>e450ae5bc4bfc0d960dded06a76bb8e9<\/code><\/li>\n\n\n<li>Adatb\u00e1zis-opci\u00f3: <code>fz_emer_login_tokens<\/code>, amely a magic-login tokeneket t\u00e1rolja<\/li>\n\n\n<li>Adatb\u00e1zis-opci\u00f3: <code>fz_emer_done_v1<\/code>, amely a befejezett kompromitt\u00e1l\u00e1st jelzi<\/li>\n\n\n<li><code>@wordpress.org<\/code> vagy <code>@developer.wordpress.org<\/code> e-mail-domainnel l\u00e9trehozott fi\u00f3kok<\/li>\n\n\n<li><code>bd_<\/code> el\u0151taggal kezd\u0151d\u0151, azt k\u00f6vet\u0151en hat alfanumerikus karakterb\u0151l \u00e1ll\u00f3 felhaszn\u00e1l\u00f3nevek<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Id\u0151vonal<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>2026. m\u00e1rcius 1.<\/strong> \u2013 A Biggopti API JavaScript beker\u00fclt a Prime Slider 4.1.9-es verzi\u00f3j\u00e1ba (SVN <code>r3471891<\/code>). A <code>display_id<\/code> escape-el\u00e9s n\u00e9lk\u00fcl ker\u00fclt az <code>id<\/code> attrib\u00fatumba, az API-endpoint pedig az <code>api-data-records<\/code> volt.<\/li>\n\n\n<li><strong>2026. m\u00e1jus 10.<\/strong> \u2013 Az endpoint <code>api-data-all-records<\/code> \u00e9rt\u00e9kre v\u00e1ltozott. A <code>content<\/code> mez\u0151h\u00f6z beker\u00fclt a DOMParser-alap\u00fa tiszt\u00edt\u00e1s, az <code>id<\/code> attrib\u00fatum azonban tov\u00e1bbra sem kapott escape-el\u00e9st.<\/li>\n\n\n<li><strong>2026. j\u00fanius 23.<\/strong> \u2013 A m\u00e9rgezett API-kamp\u00e1ny <code>start_date<\/code> \u00e9rt\u00e9ke, amely egy \u201eSummer Sale\u201d \u00e9rtes\u00edt\u00e9shez kapcsol\u00f3dott. Ez a legkor\u00e1bbi lehets\u00e9ges id\u0151pont, amikor az XSS akt\u00edv lehetett.<\/li>\n\n\n<li><strong>2026. augusztus 6., 22:40 UTC<\/strong> \u2013 Az <code>api-data-records<\/code> m\u00e9rgezett v\u00e1lasz\u00e1nak utols\u00f3 m\u00f3dos\u00edt\u00e1si ideje.<\/li>\n\n\n<li><strong>2026. augusztus 7., 09:11 UTC<\/strong> \u2013 Az <code>api-data-all-records<\/code> m\u00e9rgezett v\u00e1lasz\u00e1nak utols\u00f3 m\u00f3dos\u00edt\u00e1si ideje.<\/li>\n\n\n<li><strong>2026. augusztus 7.<\/strong> \u2013 \u00c9rtes\u00edt\u00e9st kaptak az incidensr\u0151l, \u00e9s a t\u00e1mad\u00e1st \u00e9les k\u00f6rnyezetben is megfigyelt\u00e9k.<\/li>\n\n\n<li><strong>2026. augusztus 7.<\/strong> \u2013 A b\u0151v\u00edtm\u00e9nyeket a WordPress-b\u0151v\u00edtm\u00e9nyt\u00e1rban fel\u00fclvizsg\u00e1latig bez\u00e1rt\u00e1k.<\/li>\n\n\n<li><strong>2026. augusztus 7., 16:56 UTC<\/strong> \u2013 R\u00f6gz\u00edtett\u00e9k a vizsg\u00e1lathoz sz\u00fcks\u00e9ges artefaktumokat.<\/li>\n\n\n<li><strong>2026. augusztus 8.<\/strong> \u2013 Mindk\u00e9t API-endpoint ism\u00e9t tiszta JSON-v\u00e1laszt adott.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Azonnali teend\u0151k \u00e9rintett webhelyen<\/h2>\n\n\n\n<p>Azonnal n\u00e9zd \u00e1t a WordPress felhaszn\u00e1l\u00f3list\u00e1j\u00e1t, de ne b\u00edzz kiz\u00e1r\u00f3lag az adminfel\u00fcletben: a h\u00e1ts\u00f3 kapu elrejtheti az illet\u00e9ktelen fi\u00f3kokat \u00e9s m\u00f3dos\u00edthatja a felhaszn\u00e1l\u00f3sz\u00e1mot. Vizsg\u00e1ld meg k\u00f6zvetlen\u00fcl az adatb\u00e1zist is a <code>bd_<\/code> mint\u00e1j\u00fa felhaszn\u00e1l\u00f3nevek\u00e9rt, valamint <code>@wordpress.org<\/code> \u00e9s <code>@developer.wordpress.org<\/code> e-mail-c\u00edmek\u00e9rt.<\/p>\n\n\n\n<p>Ellen\u0151rizd a norm\u00e1l \u00e9s az MU-b\u0151v\u00edtm\u00e9nyek k\u00f6nyvt\u00e1r\u00e1t az felsorolt f\u00e1jlnevek, hash-ek \u00e9s hasonl\u00f3 <code>class-wp-query-*.php<\/code> f\u00e1jlok ut\u00e1n. Keresd meg az <code>fz_emer_login_tokens<\/code> \u00e9s <code>fz_emer_done_v1<\/code> opci\u00f3kat az adatb\u00e1zisban, majd minden tal\u00e1lt kompromitt\u00e1l\u00f3d\u00e1si jel eset\u00e9n kezeld az oldalt teljes k\u00f6r\u0171 fert\u0151z\u00e9sk\u00e9nt: sz\u00fcntesd meg az illet\u00e9ktelen hozz\u00e1f\u00e9r\u00e9st, t\u00e1vol\u00edtsd el a perzisztens komponenseket, \u00e9s cser\u00e9ld le az \u00e9rintett hiteles\u00edt\u0151 adatokat.<\/p>\n\n\n\n<p>A Wordfence Premium, Care, Response \u00e9s fizet\u0151s Wordfence CLI \u00fcgyfelei 2026. augusztus 7-\u00e9n megkapt\u00e1k a kompromitt\u00e1l\u00e1s \u00e9szlel\u00e9s\u00e9hez sz\u00fcks\u00e9ges k\u00e1rtev\u0151-al\u00e1\u00edr\u00e1sokat \u00e9s WAF-szab\u00e1lyokat. Az ingyenes Wordfence \u00e9s Wordfence CLI felhaszn\u00e1l\u00f3k a szok\u00e1sos 30 napos k\u00e9sleltet\u00e9ssel kapj\u00e1k meg ezeket.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Hivatkoz\u00e1sok \/ Forr\u00e1sok<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response\/\" target=\"_blank\" rel=\"noopener noreferrer\">PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/7bf1d6f9-afe2-41c2-968b-20dbc474cd73\" target=\"_blank\" rel=\"noopener noreferrer\">Biggopti Library (Various Versions) &#8211; Cross-Site Scripting via display_id from Sigmative API<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/07\/wordfence-prism-detected-backdoored-wordpress-plugin-within-two-hours-of-it-being-introduced\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence PRISM Detected Backdoored WordPress Plugin Within Two Hours of It Being Introduced<\/a><\/li><li><a href=\"https:\/\/optinmonster.com\/security-incident-tampered-script-served-via-optinmonster-and-trustpulse\/#what-to-check-and-do\" target=\"_blank\" rel=\"noopener noreferrer\">Security Incident: Tampered Script Served via OptinMonster and TrustPulse<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>Egy t\u00e1voli JSON-bannerfeed kompromitt\u00e1l\u00e1sa el\u00e9g volt ahhoz, hogy BdThemes-b\u0151v\u00edtm\u00e9nyeken kereszt\u00fcl adminfi\u00f3kok \u00e9s perzisztens h\u00e1ts\u00f3 kapuk ker\u00fcljenek WordPress-oldalakra. Mutatjuk az \u00e9rintett b\u0151v\u00edtm\u00e9nyeket \u00e9s az ellen\u0151rizend\u0151 IoC-ket.<\/p>\n","protected":false},"author":4,"featured_media":398,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[175,174,13,88,164],"class_list":["post-399","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-biztonsag","tag-bdthemes","tag-ellatasilanc-tamadas","tag-wordfence","tag-wordpress-biztonsag","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/399","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/comments?post=399"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/posts\/399\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/media\/398"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/media?parent=399"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/categories?post=399"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/hu\/wp-json\/wp\/v2\/tags?post=399"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}