We have encountered a notable surge in traffic originating from the Netherlands (some of the source IP’s are 176.222.55.137, 176.222.55.139 both listed here https://www.wordfence.com/threat-intel and 93.174.93.127), specifically targeting the path /wp-json/tdw/save_css, beginning on the 14th of December.
This surge is happening across multiple websites hosted on WPEngine or Digital Ocean. Despite updating all websites from version 12.6.2 to 12.6.3, the increased traffic persists.
Is this related to Balada Injector? https://blog.sucuri.net/2023/10/balada-injector-targets-unpatched-tagdiv-plugin-newspaper-theme-wordpress-admins.html
In our efforts to address the issue, we have also attempted the solution outlined here: How to Disable Access to Exploitation Path for Vulnerable Code in Outdated TagDiv Composer Plugin, but without success.
Is anyone else experiencing this issue (check your Cloudflare stats) and when a fix will be released?
How to Disable Access to Exploitation Path for Vulnerable Code in Outdated TagDiv Composer Plugin: https://www.pluginvulnerabilities.com/2023/10/19/how-to-disable-access-to-exploitation-path-for-vulnerable-code-in-outdated-tagdiv-composer-plugin/
If we will block access to /wp-json/tdw/save_css would it affect the websites in any way?
Same here, this ips from Russia, Romania and Netherlands are trying to inject malware. They had the same problems months ago. Many of us were injected with a redirection code that you can see in theme options> custom code> javascript (or something similar). At least it’s seems they solved the problem blocking these petitions.
But yes, since a month ago we have had a continuous and non-stop traffic from this ips. Look at my server visit log https://ibb.co/Y7TWgxy
Hi,
Have you tried blocking them with wordfence? Something like this would work – https://prnt.sc/1V-dHi7xTQXk But it may take some time until all the URLs are blocked, as they keep changing most likely. Eventually they will all be blocked however and the attack will stop.
I think it could be done from cloudflare as well, if you use cloudflare. That URL can be blocked like this for example – https://community.cloudflare.com/t/possible-to-block-specific-page-access/106765/3 In case you are using cloudflare, this would be a very good solution because cloudflare will block them before they reach the website. But in case it isn’t possible to set up cloudflare, the wordfence method will work as well. Please try it as soon as possible.
Thank you!
Hi Anamaria
Is it possible to restrict access to /wp-json/tdw/save_css globally? Would such a restriction have any impact on the functioning of the websites? Alternatively, is there a method to entirely disable this part of the plugin?
Manually blocking these isn’t a viable solution, especially when IP addresses frequently change.
What is the purpose of /wp-json/tdw/save_css? Can you send more details?
Hi,
My colleague replied via email.
Thank you!
Hi Anamaria!
No, we didn’t receive answers to all the questions, can you follow up please?
Is it possible to restrict access to /wp-json/tdw/save_css globally? Would such a restriction have any impact on the functioning of the websites? Alternatively, is there a method to entirely disable this part of the plugin? Maybe by adding a checkbox to disable it completely – especially that we are never using the Live CSS on any of our websites.
What is the purpose of /wp-json/tdw/save_css in general? Can you send more details?
Hi,
I don’t exactly if this can be restricted globally. The only solution is to set it as I said in CloudFlare.
The live css is used to set code css, but this code can be also set in the theme panel.
Thank you!
Hi Anamaria,
Can you check with your developers team if it can be disabled? We don’t have unfortunately access to all Cloudflare accounts – but if with a switch, we could at least quickly stop the interest to this path /wp-json/tdw/save_css
Hi,
If an attacker wants to target this URL /wp-json/tdw/save_css they can do so. Even if the website uses a different theme, the attacker can still try that URL. We could add an option to be able to enable/disable the Live CSS, it will be considered. But for now in order to remove it this can only be done with a modification to the composer plugin. I think that all that removing it requires is to comment this line of code – https://prnt.sc/RtwvL5Nc4ikR -> https://prnt.sc/ymZmhdUfp57U But as I mentioned, the attacker can still try to access the URL.
Thank you!
My Wordfence also tells me about the attack, should I worry about it? Is there anything I can do? https://www.dropbox.com/scl/fi/sx00d36qrfawp4cxsegrn/save_css.png?rlkey=e2y36lemdzmh8n84ukd8tsv2u&dl=0
Tom
Yup, the same here, hopefully we would be able to disable this feature in the future.
Hi,
If an attacker wants to target this URL /wp-json/tdw/save_css they can do so. Even if the website uses a different theme, the attacker can still try that URL. We could add an option to be able to enable/disable the Live CSS, it will be considered. But for now in order to remove it this can only be done with a modification to the composer plugin. I think that all that removing it requires is to comment this line of code – https://prnt.sc/RtwvL5Nc4ikR -> https://prnt.sc/ymZmhdUfp57U But as I mentioned, the attacker can still try to access the URL.
Thank you!
