Hacking issues with Rev Slider

Recently my blog that runs Newspaper theme was hacked several times: database was modified, login account was changed… I use Dreampress service from Dreamhost and after a while, they came with the issue: the Revolution Slider plugin that comes with the theme is a vulnerable plugin! I am posting their message to me about it that says Revolution Slider version 4.6 fix the problem. I wonder if the latest Newspaper version fix that with a newer version of Rev Slider also?
Thanks.

————————————————————————
Hello,

Thanks for writing.

I found that you have the vulnerable plugin “revslider” (Revolution
Slider) installed here:

/home/wp_xv8mei/…../wp-content/plugins/revslider

This has a file disclosure vulnerability that could allow a hacker to
read your wp-config.php file. This would give them access to your MySQL
database, which in turn would give them access to your WordPress
dashboard, which in turn would give them access to your WordPress theme
and plugin files, which they could then edit and add malicious code to.
That malicious code could then be used to infect the rest of your site.

Here’s the relevant log:

179.178.117.187 – – [28/Aug/2014:09:21:57 -0700] “GET
/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
HTTP/1.1” 200 3300
“http://blog.inurl.com.br/5a046effaaf2c5fa9eceb38473cd62a7”
“0xSCANNER-INURL_blog.inurl.com.br-Flock/9.5 (Ubuntu 3.1; da;)”
179.178.117.187 – – [28/Aug/2014:09:22:00 -0700] “GET
/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
HTTP/1.1” 200 3300 “-” “curl/7.26.0”
179.178.117.187 – – [28/Aug/2014:09:22:03 -0700] “GET
/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php
HTTP/1.1” 200 3302 “-” “curl/7.26.0”

The developer recently fixed that vulnerability as of version 4.6. They
didn’t announce it as a security update but we tested it to confirm. So
make sure to update it now.

To test the exploit, visit the following URL:

http://…../wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php

If the vulnerability is still active, visiting this URL will download a
file named “admin-ajax.php” to your computer. This file will actually
contain the code from your “wp-config.php” file.
(…)

me to 🙁

Note that for those who want to fast-track it, you can buy a licensed copy of RevSlider. (I don’t know if this is necessary; I just happened to have bought it a little while back to keep it constantly updated, so I guess I lucked out)

The version included with the theme update today has newer version.

Version 4.6 SkyWood (25th August 2014)

NEW FEATURES
•Option to disable each video on mobile
•Option to disable Pan Zoom on Mobile
•Option to disable Parallax on Mobile
•Randomized Animation from the Selected Animations available now
•New Offset option for the Scroll Below Function
•New Option to set Slider Min Height – Content will be vertical centered in case content container is smaller then min height of Slider
•New Loop Options for HTML5 Videos: none, loop and stop Slider Timer or Loop till Progress Bar reaches the End

CHANGES
•Alternative First Slide wins now, even if Random Slides is enabled
•Vimeo, YouTube and HTML5 Video can be added now via options on demand instead of preadding iFrames. This will avoid Preloads delays, and slow site loadings
•Using now tp-videolayer class for Videos to identificate Video Layers better
•Class “current-sr-slide-visible” added to the Slide “li” tag which is currently Visible
•Swipe Engine Change
•Swipe Treshold Option Default 75 – The number of pixels that the user must move their finger by before it is considered a swipe.
•Swipe Min Finger Default 1 – Min Finger (touch) used for swipe
•Drag Block Vertical Default false – Scroll Auto below Slider on Vertical Swipe on Slider

BUGFIXES
•YouTube Force Rewind fix
•YouTube Mute in Second Loop fix
•Added backwards compatibility for inline CSS with WordPress versions under 3.7
•Ken Burns Dotted Overlay was not visible
•IE8 Console Group Issue – Slider was not visible in IE8
•Looping Issues if Slides has been manually hanged after Loop Stopped
•Browser Tab Change -> Broken ELements fixed. Option for Slide Change on Blur Tab / Browser also available.
•Navigation Style Preview1- Preview4 Styling issues
•Power2 Error at some Animation
•Mouse Over on Loaded PArallax Slider issue – Slider will always play parallax effect, even if Mouse was already hovering the slider at laod
•IE8 and other Old MObile Devices Fall Back on simple Transitions. CAn be forced now
•HTML5, YouTube and Vimeo Video Playback fixes

Christopher
This is such a good news! I have Rev slider license now but I feel so much more confortable with a theme update! I will download it now and start working on updating my blog.
Many many thanks! You guys rock!

@mmcmsp
BTW: the version of the Themepunch Revolution Slider plugin which was included with Newspaper 4 was “Version 4.3.8 SkyWood”; and themepunch says the vulnerability only existed in version 4.1.4 and older (which is the version included with Newspaper 3), so obviously those of you updating your themes need to remember to install the updated PLUGINS which come bundled with the theme.

Can you confirm the version of the plugin which was hacked; supposedly the last 29 versions of the plugin have been secure.

If you’re using a more recent version, you should definitely contact themepunch to make them aware of the issue to help others from being hacked also.

• This reply was modified 11 years by simchris.

@neotrope
I don’t know the version because when this happened I just installed the latest version of Rev Slider 4.6 replacing the old one. My Newspaper theme is 3.5 BUT I remember when I did the latest theme update I didn’t install the themes again…. so it’s probably an old version…
Thanks!

Great. As long as you’re newer than Rev Slider 4.1.4 you are secure now 🙂

• This reply was modified 11 years by simchris.