{"id":267,"date":"2026-08-09T10:40:29","date_gmt":"2026-08-09T08:40:29","guid":{"rendered":"https:\/\/helloblog.io\/sv\/bdthemes-supply-chain-angrepp-forgiftat-api\/"},"modified":"2026-08-09T10:40:29","modified_gmt":"2026-08-09T08:40:29","slug":"bdthemes-supply-chain-angrepp-forgiftat-api","status":"publish","type":"post","link":"https:\/\/helloblog.io\/sv\/bdthemes-supply-chain-angrepp-forgiftat-api\/","title":{"rendered":"BdThemes drabbat av supply chain-angrepp via f\u00f6rgiftat API"},"content":{"rendered":"\n<p>En komprometterad fj\u00e4rrmatad JSON-str\u00f6m har anv\u00e4nts f\u00f6r att angripa WordPress-administrat\u00f6rer som har n\u00e5got av sju BdThemes-till\u00e4gg installerat. Angreppet \u00e4ndrar inga filer i WordPress.org:s repository och kr\u00e4ver ingen till\u00e4ggsuppdatering, men kan \u00e4nd\u00e5 skapa dolda administrat\u00f6rskonton, installera webshells och etablera l\u00e5ngvarig \u00e5tkomst.<\/p>\n\n\n\n<div class=\"wp-block-group callout callout-danger is-style-danger is-layout-flow wp-block-group-is-layout-flow\" style=\"border-width:1px;border-radius:8px;padding-top:1rem;padding-right:1.5rem;padding-bottom:1rem;padding-left:1.5rem\">\n\n<h4 class=\"wp-block-heading callout-title\">P\u00e5g\u00e5ende supply chain-angrepp<\/h4>\n\n\n<p>Avinstallera eller inaktivera ber\u00f6rda BdThemes-till\u00e4gg tills vidare och unders\u00f6k webbplatsen om en administrat\u00f6r har bes\u00f6kt wp-admin sedan den 23 juni 2026. Till\u00e4ggen \u00e4r tillf\u00e4lligt st\u00e4ngda i WordPress till\u00e4ggskatalog medan de granskas.<\/p>\n\n<\/div>\n\n\n\n<h2 class=\"wp-block-heading\">En f\u00f6rgiftad API-str\u00f6m kringg\u00e5r filkontroller<\/h2>\n\n\n\n<p>Angreppet \u00e4r en <strong>supply chain-kompromettering<\/strong>, allts\u00e5 att angriparen utnyttjar en leverant\u00f6r eller en delad komponent f\u00f6r att n\u00e5 dess anv\u00e4ndare. I det h\u00e4r fallet \u00e4ndrade angriparen inte en enda k\u00e4llkodsfil i WordPress.org:s officiella repository. I st\u00e4llet fick angriparen skriv\u00e5tkomst till BdThemes lagringsyta och ersatte legitima JSON-svar med skadliga poster.<\/p>\n\n\n\n<p>BdThemes-till\u00e4ggen inneh\u00e5ller den interna komponenten <em>Biggopti<\/em>. Komponenten h\u00e4mtar kampanjbanners fr\u00e5n leverant\u00f6rens API och visar dem i WordPress adminpanel. API:t anv\u00e4nder statiska JSON-filer fr\u00e5n en DigitalOcean Spaces-bucket bakom Cloudflare, inte en dynamisk applikationsserver.<\/p>\n\n\n\n<p>Det inneb\u00e4r att vanliga integritetskontroller av filer inte ser angreppet: inga till\u00e4ggsfiler \u00e4ndras p\u00e5 disken. En brandv\u00e4gg f\u00f6r webbapplikationer har ocks\u00e5 begr\u00e4nsad insyn, eftersom den skadliga JavaScript-koden k\u00f6rs i en redan autentiserad administrat\u00f6rs webbl\u00e4sare n\u00e4r den l\u00e4ser in en wp-admin-sida.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Ber\u00f6rda till\u00e4gg och s\u00e5rbarhetens status<\/h2>\n\n\n\n<p>S\u00e5rbarheten finns i Biggopti-biblioteket i flera versioner. Den har CVSS-betyget <strong>5,4 (Medium)<\/strong> och saknar korrigering. Bristen \u00e4r en cross-site scripting-s\u00e5rbarhet (XSS), d\u00e4r otillr\u00e4cklig output escaping av parametern <code>display_id<\/code> fr\u00e5n Sigmative API l\u00e5ter den som styr API-servern injicera skript som k\u00f6rs n\u00e4r n\u00e5gon \u00f6ppnar den injicerade sidan.<\/p>\n\n\n\n<p>F\u00f6ljande till\u00e4gg omfattas av incidenten:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Element Pack Addons for Elementor &#8211; <code>bdthemes-element-pack-lite<\/code><\/li>\n\n\n<li>Prime Slider Addons for Elementor &#8211; <code>bdthemes-prime-slider-lite<\/code><\/li>\n\n\n<li>Pixel Gallery Addons for Elementor &#8211; <code>pixel-gallery<\/code><\/li>\n\n\n<li>Ultimate Post Kit Addons for Elementor &#8211; <code>ultimate-post-kit<\/code><\/li>\n\n\n<li>Ultimate Store Kit &#8211; Addon For WooCommerce, EDD and Elementor &#8211; <code>ultimate-store-kit<\/code><\/li>\n\n\n<li>Live Copy Paste for Elementor &#8211; <code>live-copy-paste<\/code><\/li>\n\n\n<li>Smart Admin Assistant &#8211; <code>smart-admin-assistant<\/code><\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">S\u00e5 fungerar XSS-bristen<\/h2>\n\n\n\n<p>Varje BdThemes-till\u00e4gg som anv\u00e4nder Biggopti laddar ett JavaScript-bibliotek under hooken <code>admin_init<\/code>. Skriptet k\u00f6rs d\u00e4rf\u00f6r ovillkorligen vid varje sidladdning i wp-admin och h\u00e4mtar bannerdata fr\u00e5n leverant\u00f6rens API-endpoint.<\/p>\n\n\n\n<p>N\u00e4r skriptet bygger ett HTML-element i DOM:en l\u00e4gger det in f\u00e4ltet <code>display_id<\/code> direkt i attributet <code>id<\/code>. Koden escape:ar inte v\u00e4rdet p\u00e5 klientsidan, s\u00e5 ett manipulerat JSON-svar kan avsluta <code>id<\/code>-attributet och injicera ytterligare HTML-attribut eller JavaScript-h\u00e4ndelser.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>\/\/ display_id anv\u00e4nds utan escaping\nvar f = t.display_id || t.id || &quot;default&quot;;\nvar m = &quot;bdt-admin-biggopti-api-biggopti-&quot; + f;\nA = 'id=&quot;' + m + '&quot;';\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#6A737D\">\/\/ display_id anv\u00e4nds utan escaping<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> f <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> t.display_id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#E1E4E8\"> t.id <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"default\"<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#9ECBFF\"> \"bdt-admin-biggopti-api-biggopti-\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> f;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#79B8FF\">A<\/span><span style=\"color:#F97583\"> =<\/span><span style=\"color:#9ECBFF\"> 'id=\"'<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> m <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> '\"'<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>I samma kod hanterar komponenten d\u00e4remot attributet <code>data-display-id<\/code> med escaping. Funktionen ers\u00e4tter <code>&amp;<\/code>, <code>&lt;<\/code>, <code>&gt;<\/code>, och dubbla citattecken med HTML-entiteter. Den senare skydds\u00e5tg\u00e4rden omfattar inte det s\u00e5rbara <code>id<\/code>-attributet.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function escapeAttribute(value) {\n  return (value || &quot;&quot;)\n    .replace(\/&amp;\/g, &quot;&amp;amp;&quot;)\n    .replace(\/&lt;\/g, &quot;&amp;lt;&quot;)\n    .replace(\/&gt;\/g, &quot;&amp;gt;&quot;)\n    .replace(\/&quot;\/g, &quot;&amp;quot;&quot;);\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> escapeAttribute<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#FFAB70\">value<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> (value <\/span><span style=\"color:#F97583\">||<\/span><span style=\"color:#9ECBFF\"> \"\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x26;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;amp;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">&#x3C;<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;lt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">><\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;gt;\"<\/span><span style=\"color:#E1E4E8\">)<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    .<\/span><span style=\"color:#B392F0\">replace<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#DBEDFF\">\"<\/span><span style=\"color:#9ECBFF\">\/<\/span><span style=\"color:#F97583\">g<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#9ECBFF\">\"&#x26;quot;\"<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>SVN-historiken visar att Prime Slider version 4.1.9, SVN-revision <code>r3471891<\/code>, inf\u00f6rde den oescape:ade attributinjektionen den 1 mars 2026. BdThemes f\u00f6rde sedan \u00f6ver koden till fler till\u00e4gg. Senare versioner lade till en DOMParser-baserad sanerare f\u00f6r bannerns inneh\u00e5llsf\u00e4lt, som tar bort farliga HTML-taggar och inline-h\u00e4ndelsehanterare. Saneraren \u00e5tg\u00e4rdade dock inte <code>id<\/code>-attributet.<\/p>\n\n\n\n<p>De f\u00f6rgiftade JSON-posterna anv\u00e4nde <code>display_id<\/code> f\u00f6r att bryta sig ur attributet och l\u00e4gga till en <code>onanimationstart<\/code>-hanterare. En CSS-animation aktiverar h\u00e4ndelsen efter ungef\u00e4r 10 millisekunder, utan synlig interaktion, n\u00e4r en inloggad administrat\u00f6r \u00f6ppnar valfri sida i adminpanelen. H\u00e4ndelsehanteraren h\u00e4mtar sedan extern JavaScript-kod fr\u00e5n angriparens infrastruktur.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Angreppets tv\u00e5 payloadkedjor<\/h2>\n\n\n\n<p>Angriparen anv\u00e4nde olika payloads beroende p\u00e5 vilket API som ett till\u00e4gg anropade. Den prim\u00e4ra payloaden <code>w2.js<\/code> riktade sig till till\u00e4gg som l\u00e4ste endpointen <code>api-data-all-records<\/code>. Den alternativa payloaden <code>x.js<\/code> l\u00e5g direkt p\u00e5 BdThemes infrastruktur och riktade sig till till\u00e4gg som l\u00e4ste <code>api-data-records<\/code>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Prim\u00e4r payload: w2.js<\/h3>\n\n\n\n<p>N\u00e4r <code>w2.js<\/code> k\u00f6r i den inloggade administrat\u00f6rens session utf\u00f6r den f\u00f6ljande kedja:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li><strong>Verifiera C2-servern:<\/strong> Skriptet kontaktar <code>ia-cdn[.]com\/fz\/c<\/code> och skickar webbplatsens origin f\u00f6r att h\u00e4mta instruktioner om m\u00e5lval. Skriptet avbryter om C2-servern svarar med statusen <code>skip<\/code> eller <code>done<\/code>.<\/li>\n\n\n<li><strong>Skapa ett obeh\u00f6rigt administrat\u00f6rskonto:<\/strong> Skriptet anv\u00e4nder <code>X-WP-Nonce<\/code> fr\u00e5n den aktiva admins session f\u00f6r att skapa en ny administrat\u00f6r via WordPress REST API. Om det inte fungerar faller skriptet tillbaka till vanliga formul\u00e4rinskick.<\/li>\n\n\n<li><strong>Installera en webshell:<\/strong> Skriptet h\u00e4mtar en falsk till\u00e4ggs-ZIP fr\u00e5n C2-servern och laddar upp den via WordPress vanliga formul\u00e4r f\u00f6r till\u00e4ggsuppladdning. Det falska till\u00e4gget maskerar sig som <code>wp-smart-thumbnails<\/code> eller ett liknande neutralt slug-namn och inneh\u00e5ller webshellen <code>emer-run.php<\/code>, som angriparen kan anropa direkt via URL.<\/li>\n\n\n<li><strong>Installera bakd\u00f6rrar som Must-Use-till\u00e4gg:<\/strong> N\u00e4r angriparen anropar <code>emer-run.php<\/code> installerar den tv\u00e5 persistensmoduler i katalogen f\u00f6r Must-Use-till\u00e4gg. De tv\u00e5 analyserade proverna hade tidsst\u00e4mplats bak\u00e5t till september 2025 f\u00f6r att sm\u00e4lta in bland legitima filsystemstider, men filnamnen kan variera mellan infektioner. Den f\u00f6rsta modulen erbjuder magic login via URL-parametern <code>?_wplogin=&lt;token&gt;<\/code> utan autentisering och riktar sig mot webbplatsens \u00e4ldsta registrerade administrat\u00f6r. Den andra modulen d\u00f6ljer sp\u00e5r genom att hooka in i WordPress databasfr\u00e5gor, g\u00f6mma de obeh\u00f6riga kontona fr\u00e5n anv\u00e4ndarlistan och minska det totala anv\u00e4ndarantalet i motsvarande grad.<\/li>\n\n\n<li><strong>Exfiltrera resultat:<\/strong> Skriptet skickar resultaten fr\u00e5n varje exekveringsfas till C2-servern med <code>navigator.sendBeacon<\/code>.<\/li>\n\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\">Alternativ payload: x.js<\/h3>\n\n\n\n<p><code>x.js<\/code> skapar f\u00f6ruts\u00e4gbara administrat\u00f6rsuppgifter fr\u00e5n den angripna webbplatsens v\u00e4rdnamn. Algoritmen ber\u00e4knar ett heltalshash fr\u00e5n varje tecken i v\u00e4rdnamnet, omvandlar det absoluta v\u00e4rdet till base36 och anv\u00e4nder de sex f\u00f6rsta tecknen.<\/p>\n\n\n\n<div class=\"wp-block-kevinbatdorf-code-block-pro\" data-code-block-pro-font-family=\"Code-Pro-JetBrains-Mono\" style=\"font-size:.875rem;font-family:Code-Pro-JetBrains-Mono,ui-monospace,SFMono-Regular,Menlo,Monaco,Consolas,monospace;line-height:1.25rem;--cbp-tab-width:2;tab-size:var(--cbp-tab-width, 2)\"><span style=\"display:block;padding:16px 0 0 16px;margin-bottom:-1px;width:100%;text-align:left;background-color:#24292e\"><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"54\" height=\"14\" viewBox=\"0 0 54 14\"><g fill=\"none\" fill-rule=\"evenodd\" transform=\"translate(1 1)\"><circle cx=\"6\" cy=\"6\" r=\"6\" fill=\"#FF5F56\" stroke=\"#E0443E\" stroke-width=\".5\"><\/circle><circle cx=\"26\" cy=\"6\" r=\"6\" fill=\"#FFBD2E\" stroke=\"#DEA123\" stroke-width=\".5\"><\/circle><circle cx=\"46\" cy=\"6\" r=\"6\" fill=\"#27C93F\" stroke=\"#1AAB29\" stroke-width=\".5\"><\/circle><\/g><\/svg><\/span><span role=\"button\" tabindex=\"0\" style=\"color:#e1e4e8;display:none\" aria-label=\"Copy\" class=\"code-block-pro-copy-button\"><pre class=\"code-block-pro-copy-button-pre\" aria-hidden=\"true\"><textarea class=\"code-block-pro-copy-button-textarea\" tabindex=\"-1\" aria-hidden=\"true\" readonly>function makeCreds() {\n  var host = siteKey();\n  var hash = 0;\n\n  for (var i = 0; i &lt; host.length; i++) {\n    hash = ((hash &lt;&lt; 5) - hash + host.charCodeAt(i)) | 0;\n  }\n\n  var n = Math.abs(hash).toString(36).slice(0, 6);\n  return {\n    user: &quot;bd_&quot; + n,\n    pass: &quot;Bd@26!&quot; + n + &quot;x&quot;\n  };\n}\n<\/textarea><\/pre><svg xmlns=\"http:\/\/www.w3.org\/2000\/svg\" style=\"width:24px;height:24px\" fill=\"none\" viewBox=\"0 0 24 24\" stroke=\"currentColor\" stroke-width=\"2\"><path class=\"with-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2m-6 9l2 2 4-4\"><\/path><path class=\"without-check\" stroke-linecap=\"round\" stroke-linejoin=\"round\" d=\"M9 5H7a2 2 0 00-2 2v12a2 2 0 002 2h10a2 2 0 002-2V7a2 2 0 00-2-2h-2M9 5a2 2 0 002 2h2a2 2 0 002-2M9 5a2 2 0 012-2h2a2 2 0 012 2\"><\/path><\/svg><\/span><pre class=\"shiki github-dark\" style=\"background-color:#24292e;color:#e1e4e8\" tabindex=\"0\"><code><span class=\"line\"><span style=\"color:#F97583\">function<\/span><span style=\"color:#B392F0\"> makeCreds<\/span><span style=\"color:#E1E4E8\">() {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> host <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#B392F0\"> siteKey<\/span><span style=\"color:#E1E4E8\">();<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> hash <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  for<\/span><span style=\"color:#E1E4E8\"> (<\/span><span style=\"color:#F97583\">var<\/span><span style=\"color:#E1E4E8\"> i <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">; i <\/span><span style=\"color:#F97583\">&#x3C;<\/span><span style=\"color:#E1E4E8\"> host.<\/span><span style=\"color:#79B8FF\">length<\/span><span style=\"color:#E1E4E8\">; i<\/span><span style=\"color:#F97583\">++<\/span><span style=\"color:#E1E4E8\">) {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    hash <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> ((hash <\/span><span style=\"color:#F97583\">&#x3C;&#x3C;<\/span><span style=\"color:#79B8FF\"> 5<\/span><span style=\"color:#E1E4E8\">) <\/span><span style=\"color:#F97583\">-<\/span><span style=\"color:#E1E4E8\"> hash <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#E1E4E8\"> host.<\/span><span style=\"color:#B392F0\">charCodeAt<\/span><span style=\"color:#E1E4E8\">(i)) <\/span><span style=\"color:#F97583\">|<\/span><span style=\"color:#79B8FF\"> 0<\/span><span style=\"color:#E1E4E8\">;<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">  }<\/span><\/span>\n<span class=\"line\"><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  var<\/span><span style=\"color:#E1E4E8\"> n <\/span><span style=\"color:#F97583\">=<\/span><span style=\"color:#E1E4E8\"> Math.<\/span><span style=\"color:#B392F0\">abs<\/span><span style=\"color:#E1E4E8\">(hash).<\/span><span style=\"color:#B392F0\">toString<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">36<\/span><span style=\"color:#E1E4E8\">).<\/span><span style=\"color:#B392F0\">slice<\/span><span style=\"color:#E1E4E8\">(<\/span><span style=\"color:#79B8FF\">0<\/span><span style=\"color:#E1E4E8\">, <\/span><span style=\"color:#79B8FF\">6<\/span><span style=\"color:#E1E4E8\">);<\/span><\/span>\n<span class=\"line\"><span style=\"color:#F97583\">  return<\/span><span style=\"color:#E1E4E8\"> {<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    user: <\/span><span style=\"color:#9ECBFF\">\"bd_\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> n,<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">    pass: <\/span><span style=\"color:#9ECBFF\">\"Bd@26!\"<\/span><span style=\"color:#F97583\"> +<\/span><span style=\"color:#E1E4E8\"> n <\/span><span style=\"color:#F97583\">+<\/span><span style=\"color:#9ECBFF\"> \"x\"<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">  };<\/span><\/span>\n<span class=\"line\"><span style=\"color:#E1E4E8\">}<\/span><\/span><\/code><\/pre><\/div>\n\n\n\n<p>Skriptet anv\u00e4nder anv\u00e4ndarnamnet <code>bd_<\/code> f\u00f6ljt av hashen, l\u00f6senordet <code>Bd@26!<\/code> f\u00f6ljt av hashen och <code>x<\/code>, samt en e-postadress med dom\u00e4nen <code>@wordpress.org<\/code>. Eftersom uppgifterna \u00e4r deterministiska beh\u00f6ver angriparen inte spara en central lista \u00f6ver angripna webbplatser. Vid incidenthantering kan du i st\u00e4llet ber\u00e4kna det f\u00f6rv\u00e4ntade anv\u00e4ndarnamnet och l\u00f6senordet f\u00f6r en misst\u00e4nkt dom\u00e4n.<\/p>\n\n\n\n<p>D\u00e4refter h\u00e4mtar skriptet <code>\/wp-admin\/user-new.php<\/code>, extraherar nonce-v\u00e4rdet f\u00f6r att skapa anv\u00e4ndare och skickar ett formul\u00e4r som tilldelar rollen <code>administrator<\/code>. Skriptet sparar en lokal flagga i <code>localStorage<\/code> n\u00e4r det kan g\u00f6ra det, rapporterar anv\u00e4ndarnamn, l\u00f6senord, webbplatsens origin, logout-URL, aktuell sida och resultatet till C2-servern samt anv\u00e4nder <code>sendBeacon<\/code> eller en <code>fetch<\/code>-beg\u00e4ran med <code>no-cors<\/code> som reservv\u00e4g.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Omfattning och bakomliggande infrastruktur<\/h2>\n\n\n\n<p>C2-dom\u00e4nen kopplas till samma akt\u00f6rer som l\u00e5g bakom supply chain-angreppen mot Advanced Responsive Video Embedder och OptinMonster under de tv\u00e5 f\u00f6reg\u00e5ende m\u00e5naderna. Kampanjen har som m\u00e5l att etablera utbredd, tyst administrat\u00f6rspersistens och fj\u00e4rrk\u00f6rning av kod i WordPress-milj\u00f6er.<\/p>\n\n\n\n<p>Angriparen beh\u00f6vde inte f\u00e5 \u00e5tkomst till enskilda WordPress-webbplatser. Det r\u00e4ckte att f\u00f6rgifta ett betrott fl\u00f6de f\u00f6r kampanjdata och utnyttja visningskoden i administrat\u00f6rens webbl\u00e4sare. Att de skadliga JSON-posterna och <code>x.js<\/code> laddades upp direkt till leverant\u00f6rens bucket tyder p\u00e5 en allvarlig kompromettering av BdThemes molnlagringsuppgifter eller interna infrastruktur.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Indikatorer p\u00e5 kompromettering<\/h2>\n\n\n\n<p>S\u00f6k igenom webbservern, WordPress-installationen och databasen efter f\u00f6ljande indikatorer. De f\u00f6rgiftade API-endpointarna \u00e4r rensade, men en tidigare k\u00f6rd payload kan ha l\u00e4mnat kvar konton och persistensmekanismer.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Externa resurser<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Prim\u00e4r payload: <code>ia-cdn[.]com\/fz\/w2.js<\/code><\/li>\n\n\n<li>C2-endpoint f\u00f6r beacon-data: <code>ia-cdn[.]com\/fz\/c<\/code><\/li>\n\n\n<li>F\u00f6rgiftad leverant\u00f6rsendpoint, nu rensad: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-all-records<\/code><\/li>\n\n\n<li>F\u00f6rgiftad leverant\u00f6rsendpoint, nu rensad: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/api-data-records<\/code><\/li>\n\n\n<li>F\u00f6rgiftad leverant\u00f6rsresurs, nu rensad: <code>api[.]sigmative[.]io\/prod\/store\/api\/biggopti\/x.js<\/code><\/li>\n\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Filer, databasposter och konton<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Webshell: <code>emer-run.php<\/code> &#8211; MD5: <code>1024732009983dd5e54b4cf5593f04d4<\/code><\/li>\n\n\n<li>Magic-login-bakd\u00f6rr som MU-till\u00e4gg: <code>class-wp-token-validate.php<\/code> &#8211; MD5: <code>7719cd98a35ffad2771f26d1ceab7d27<\/code><\/li>\n\n\n<li>Stealth-modul som MU-till\u00e4gg: <code>class-wp-query-9d127ff3.php<\/code>, eller liknande namn enligt m\u00f6nstret <code>class-wp-query-*.php<\/code> &#8211; MD5: <code>9aadc3e5c5242b273bd17c5bdc358845<\/code><\/li>\n\n\n<li>MU-till\u00e4gget \u201dHealth Check\u201d: <code>wp-cache-optimizer.php<\/code> &#8211; MD5: <code>e450ae5bc4bfc0d960dded06a76bb8e9<\/code><\/li>\n\n\n<li>Databasoptionen <code>fz_emer_login_tokens<\/code>, som lagrar token f\u00f6r magic login.<\/li>\n\n\n<li>Databasoptionen <code>fz_emer_done_v1<\/code>, som markerar att komprometteringen har slutf\u00f6rts.<\/li>\n\n\n<li>Konton med e-postdom\u00e4nen <code>@wordpress.org<\/code> eller <code>@developer.wordpress.org<\/code>.<\/li>\n\n\n<li>Anv\u00e4ndarnamn som matchar <code>bd_<\/code> f\u00f6ljt av sex alfanumeriska tecken.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Tidslinje<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li><strong>1 mars 2026:<\/strong> Biggoptis API-JavaScript l\u00e4ggs till i Prime Slider 4.1.9, SVN <code>r3471891<\/code>. <code>display_id<\/code> hamnar oescape:at i ett <code>id<\/code>-attribut och till\u00e4gget anv\u00e4nder endpointen <code>api-data-records<\/code>.<\/li>\n\n\n<li><strong>10 maj 2026:<\/strong> Endpointen byts till <code>api-data-all-records<\/code>. En DOMParser-sanering l\u00e4ggs till f\u00f6r inneh\u00e5llsf\u00e4ltet, men <code>id<\/code>-attributet l\u00e4mnas oescape:at.<\/li>\n\n\n<li><strong>23 juni 2026:<\/strong> <code>start_date<\/code> i den f\u00f6rgiftade API-kampanjen anges f\u00f6r meddelandet \u201dSummer Sale\u201d. Detta \u00e4r det tidigaste m\u00f6jliga datumet d\u00e5 XSS-angreppet kan ha varit aktivt.<\/li>\n\n\n<li><strong>6 augusti 2026, 22:40 UTC:<\/strong> Senaste \u00e4ndringstid f\u00f6r den f\u00f6rgiftade <code>api-data-records<\/code>-resursen.<\/li>\n\n\n<li><strong>7 augusti 2026, 09:11 UTC:<\/strong> Senaste \u00e4ndringstid f\u00f6r den f\u00f6rgiftade <code>api-data-all-records<\/code>-resursen.<\/li>\n\n\n<li><strong>7 augusti 2026:<\/strong> Angreppet observeras i praktiken och s\u00e4kerhetsteamet f\u00e5r information om incidenten.<\/li>\n\n\n<li><strong>7 augusti 2026:<\/strong> WordPress till\u00e4ggskatalog st\u00e4nger de ber\u00f6rda till\u00e4ggen i v\u00e4ntan p\u00e5 granskning.<\/li>\n\n\n<li><strong>7 augusti 2026, 16:56 UTC:<\/strong> Utredningen samlar in artefakter.<\/li>\n\n\n<li><strong>8 augusti 2026:<\/strong> B\u00e5da API-endpointarna returnerar \u00e5ter rena JSON-svar.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Granska installationen nu<\/h2>\n\n\n\n<p>B\u00f6rja med att inventera om n\u00e5got av de sju till\u00e4ggen finns eller har funnits p\u00e5 webbplatsen. Granska sedan anv\u00e4ndarlistan direkt i databasen, inte bara i WordPress adminpanel, eftersom stealth-modulen kan d\u00f6lja konton och justera anv\u00e4ndarantalen. Kontrollera \u00e4ven katalogerna f\u00f6r vanliga till\u00e4gg och Must-Use-till\u00e4gg samt optionstabellen efter samtliga indikatorer ovan.<\/p>\n\n\n\n<p>Wordfence Premium, Care, Response och betalande Wordfence CLI-kunder fick signaturer f\u00f6r skadlig kod och WAF-regler den 7 augusti 2026. Wordfence Free och kostnadsfria Wordfence CLI f\u00e5r samma signaturer och regler efter den vanliga f\u00f6rdr\u00f6jningen p\u00e5 30 dagar. En fils\u00f6kning r\u00e4cker dock inte ensam, eftersom den initiala komprometteringen inte beh\u00f6ver \u00e4ndra n\u00e5gra befintliga till\u00e4ggsfiler.<\/p>\n\n\n<div class=\"references-section\">\n                <h2>Referenser \/ K\u00e4llor<\/h2>\n                <ul class=\"references-list\"><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/08\/psa-supply-chain-compromise-in-bdthemes-ecosystem-via-poisoned-api-response\/\" target=\"_blank\" rel=\"noopener noreferrer\">PSA: Supply Chain Compromise in BdThemes Ecosystem via Poisoned API Response<\/a><\/li><li><a href=\"https:\/\/www.wordfence.com\/blog\/2026\/07\/wordfence-prism-detected-backdoored-wordpress-plugin-within-two-hours-of-it-being-introduced\/\" target=\"_blank\" rel=\"noopener noreferrer\">Wordfence Prism Detected Backdoored WordPress Plugin Within Two Hours of it Being Introduced<\/a><\/li><li><a href=\"https:\/\/optinmonster.com\/security-incident-tampered-script-served-via-optinmonster-and-trustpulse\/#what-to-check-and-do\" target=\"_blank\" rel=\"noopener noreferrer\">Security Incident: Tampered Script Served via OptinMonster and TrustPulse<\/a><\/li><\/ul>\n            <\/div>","protected":false},"excerpt":{"rendered":"<p>En komprometterad JSON-str\u00f6m i BdThemes-ekosystemet kan ha gett angripare administrat\u00f6rsbeh\u00f6righet p\u00e5 WordPress-webbplatser utan att \u00e4ndra en enda till\u00e4ggsfil. H\u00e4r \u00e4r ber\u00f6rda till\u00e4gg, attackkedjan och indikatorerna du m\u00e5ste kontrollera.<\/p>\n","protected":false},"author":62,"featured_media":266,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[11,144,10,145,133],"class_list":["post-267","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sakerhet","tag-sakerhet","tag-supply-chain","tag-wordpress","tag-wordpress-tillagg","tag-xss"],"_links":{"self":[{"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/posts\/267","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/users\/62"}],"replies":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/comments?post=267"}],"version-history":[{"count":0,"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/posts\/267\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/media\/266"}],"wp:attachment":[{"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/media?parent=267"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/categories?post=267"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/helloblog.io\/sv\/wp-json\/wp\/v2\/tags?post=267"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}