PT-2021-22066 · WordPress · Brizy – Page Builder

Ramuel Gall · Published 2021-10-14 · Updated 2022-07-05 · CVE-2021-38346

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Brizy Page Builder plugin versions <= 2.3.11 for WordPress

Description The issue allows authenticated users to upload executable files to a location of their choice using the "brizy create block screenshot" AJAX action. The file name is determined by the id parameter, which can be modified to perform directory traversal by prepending "../". The file contents are populated via the ibsf parameter, which is base64-decoded and written to the file. Although the plugin adds a .jpg extension to uploaded filenames, a double extension attack is still possible, allowing executable files to be uploaded, for example, a file named "shell.php" would be saved as "shell.php.jpg" and could be executable on certain configurations.

Recommendations For Brizy Page Builder plugin versions <= 2.3.11, update to a version greater than 2.3.11 to resolve the issue. As a temporary workaround, consider disabling the brizy create block screenshot AJAX action until a patch is available. Restrict access to the id and ibsf parameters to minimize the risk of exploitation. Avoid using the id parameter with "../" to prevent directory traversal attacks.

Fix

Unrestricted File Upload

XSS

Path traversal

Weakness Enumeration

CWE-434

CWE-79

CWE-22

Related Identifiers

CVE-2021-38346

Affected Products

Brizy – Page Builder

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-38346 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38346 · Vendor Advisory
• https://wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover · Note
• https://t.me/cibsecurity/30582 · Telegram Post