In February 2024, security researchers discovered a critical vulnerability in Bricks Builder, a popular WordPress page builder plugin. This bug, tracked as CVE-2024-25600, is a Code Injection flaw that allows attackers to inject malicious code – potentially giving them total control over your website. If you’re using Bricks Builder, especially versions through 1.9.6, you need to take action. In this article, we’ll break down what happened, how the exploit works, and what you should do now.

What Is CVE-2024-25600?

CVE-2024-25600 is categorized as "Improper Control of Generation of Code ('Code Injection')." In simple terms, this means the plugin doesn’t properly verify or sanitize the code that’s being processed. A hacker could create a specially crafted payload, inject it into the builder, and the plugin would execute that code with high privileges — potentially as your website’s admin.

Affected Versions

- Bricks Builder from unknown (n/a) through 1.9.6

The Heart of the Problem: How Does This Work?

Bricks Builder lets users add custom code and dynamic content into websites. This powerful feature is also its Achilles heel: if an attacker finds a way to inject code where Bricks fails to filter user input, that code runs as if the site owner wrote it.

Attack Scenario

1. A logged-in user (maybe even with lower privileges, depending on how the builder is configured) submits a payload like PHP or JavaScript via a builder widget, custom field, or backend code field.

Real-World Code Example

Here’s a simplified snippet showing how a vulnerable code segment might look inside a plugin like Bricks Builder:

// Hypothetical Bricks Builder handler, vulnerable to code injection
$user_input = $_POST['custom_code']; // Value from user-submitted field

// Problem: The input is used directly
eval($user_input);

Suppose the attacker sends this as custom_code

file_put_contents('backdoor.php', '<?php system($_GET["cmd"]); ?>');

Now, a backdoor.php file is created on your server, letting them run commands at will!

Exploit in the Wild – Step-by-Step

To demonstrate the risk, here’s an actual exploit sequence (for educational purposes and defending your site only!):

2. Inject the following payload via the form

<?php if(!file_exists('hacked.txt')){ file_put_contents('hacked.txt',"exploited"); } ?>

3. When the page is rendered, Bricks Builder processes the injected code, and you find 'hacked.txt' created in your site root.

For more aggressive attackers, this method could be escalated to drop a full remote shell or exfiltrate the wp-config.php file.

References & Further Reading

- CVE-2024-25600 Official NVD Page
- Bricks Builder changelog (check for “Security” patches)
- Wordfence Blog on Page Builder Vulnerabilities

If you’re running Bricks Builder (any version through 1.9.6), take action immediately!

1. Update Bricks Builder: Upgrade to the latest version – Bricks devs have reportedly addressed this in versions above 1.9.6.
2. Scan Your Site: Use tools like Wordfence or Sucuri SiteCheck to spot hidden shells or altered files.

Audit User Permissions: Remove suspicious users and limit who can use custom code features.

4. Monitor for New Files: Watch your server for strange files (like backdoor.php or hacked.txt).

Conclusion

CVE-2024-25600 is a serious code injection threat. If left unchecked, it can spell disaster for your WordPress website. The takeaway: Always update plugins, be wary of user-supplied code, and audit your sites for changes. Cybercriminals are getting smarter, but a quick response can keep your site safe.

Got questions? Want to share your experience with Bricks vulnerabilities? Leave a comment below or join the Bricks Builder Community Forum!

Timeline

Published on: 06/04/2024 13:15:51 UTC
Last modified on: 08/01/2024 23:44:09 UTC