{"id":313,"date":"2024-06-21T07:30:37","date_gmt":"2024-06-21T07:30:37","guid":{"rendered":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/06\/21\/wordpress-plugin-under-attack-bricks-builder-bug-enables-rce-sc-media\/"},"modified":"2024-06-21T07:30:37","modified_gmt":"2024-06-21T07:30:37","slug":"wordpress-plugin-under-attack-bricks-builder-bug-enables-rce-sc-media","status":"publish","type":"post","link":"https:\/\/www.yellowfalconmedia.com\/blog\/2024\/06\/21\/wordpress-plugin-under-attack-bricks-builder-bug-enables-rce-sc-media\/","title":{"rendered":"WordPress plugin under attack; Bricks Builder bug enables RCE – SC Media"},"content":{"rendered":"

WordPress Bricks Builder, a popular site building plugin and WordPress theme, is being actively targeted by hackers due to a critical vulnerability that allows unauthenticated attackers to perform remote code execution (RCE).
The Bricks plugin vulnerability, tracked as CVE-2024-25600, \u201cmeans that anybody can run arbitrary commands and take over the site\/server,\u201d according to WordPress development and security company Snicco<\/a>, which discovered the bug. CVE-2024-25600 has a critical CVSS score of 9.8.
Snicco reported the vulnerability to the Bricks developers on Feb. 10, and a patch was released on Feb. 13<\/a>. Technical details about the bug were first disclosed Sunday; on the same day, active exploitation of the flaw was reported<\/a> by WordPress vulnerability protection company Patchstack.
Attackers targeting CVE-2024-25600 have been spotted using malware designed to disable WordPress security plugins, according to Patchstack.<\/p>\n

Bricks Builder version 1.9.6 and all earlier versions are vulnerable to unauthenticated RCE. Bricks users must update to versions 1.9.6.1 for protection against attack.
The Bricks developers also noted that users should update any site backups to the 1.9.6.1 version, as restoring from an outdated backup could reintroduce the vulnerability.
Two major flaws in Bricks Builder were uncovered by Snicco \u2013 one that allowed for arbitrary code execution and another that allowed any unauthenticated user to call a Brick REST API endpoint.
The plugin uses the PHP eval function to execute the variable $php_query_raw, the contents of which can be injected by an attacker via a crafted request to the Brick REST API.
The PHP eval function is incredibly risky due to its ability to execute arbitrary PHP code and its use is generally discouraged, as noted by both Snicco and the PHP group itself<\/a>.
\u201cThis function is extremely dangerous, to be honest, and should never be used,\u201d Snicco security researcher Calvin Alkan wrote.
Additionally, in a proof-of-concept for CVE-2024-25600 exploitation, Alkan noted that calls to the Bricks REST API could be made without proper permission checks because the render_element_permission_check function only checked for a valid \u201cnumber used once\u201d (nonce) token to authorize the request.
A valid nonce can easily be retrieved from the HTML on the front end of any Bricks WordPress site, the Snicco researchers noted. WordPress\u2019 developer resources site<\/a> notes that nonces \u201cshould never be relied on for authentication, authorization, or access control.\u201d
Snicco demonstrated successful exploitation of the Bricks Builder bug to replace every page on a WordPress site with a GIF of the Kool-Aid mascot breaking through a brick wall.
CVE-2024-25600 has been actively exploited since at least Feb. 14, as detected by Patchstack.
Patchstack researchers observed the use of malware post-exploitation that includes a feature to disable WordPress security plugins like Wordfence and Sucuri.
Most attacks against the Bricks vulnerability come from seven IP addresses identified by Patchstack in their advisory<\/a>. Several of these IP addresses have been reported as targeting WordPress sites through various methods as early as April 2023, according to information available from AbuseIPDB<\/a>.
Wordfence\u2019s Vulnerability Database page for CVE-2024-25600<\/a> notes 36 attacks targeting the vulnerability were blocked within 24 hours, as of Feb. 19.
The Bricks plugin was estimated to have about 25,000 active installations when the vulnerability was disclosed.
Another WordPress plugin vulnerability came under mass attack earlier this year when the Popup Builder plugin was targeted by the Balada Injector campaign<\/a>. More than 6,700 WordPress sites using Popup Builder were infected due to a cross-site scripting flaw tracked as CVE-2023-6000<\/a>.
Last October, Balada Injector struck 17,000 WordPress sites<\/a>, including 9,000 affected by a bug (CVE-2023-3169<\/a>) in the page building plugin TagDiv Composer.
It is unknown whether Balada Injector, which has infected at least a million WordPress sites since 2017<\/a>, is involved in exploitation of CVE-2024-25600.
Sponsored by <\/span>Imperva<\/span><\/span><\/a><\/span>SC <\/span>Staff<\/span><\/span><\/a><\/span>Shaun <\/span>Nichols<\/span><\/span><\/a><\/span>

By clicking the Subscribe button below, you agree to SC Media Terms and Conditions<\/a> and <\/span>Privacy Policy<\/a>.<\/p>\n

Copyright \u00a9 2024 CyberRisk Alliance, LLC All Rights Reserved. This material may not be published, broadcast, rewritten or redistributed in any form without prior authorization.
Your use of this website constitutes acceptance of CyberRisk Alliance <\/span>Privacy Policy<\/a> and <\/span>Terms & Conditions<\/a>.<\/span><\/p>\n

source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

WordPress Bricks Builder, a popular site building plugin and WordPress theme, is being actively targeted by hackers due to a critical vulnerability that allows unauthenticated attackers to perform remote code execution (RCE).The Bricks plugin vulnerability, tracked as CVE-2024-25600, \u201cmeans that anybody can run arbitrary commands and take over the site\/server,\u201d…<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"_uf_show_specific_survey":0,"_uf_disable_surveys":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-313","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/313","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/comments?post=313"}],"version-history":[{"count":0,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/posts\/313\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/media?parent=313"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/categories?post=313"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yellowfalconmedia.com\/blog\/wp-json\/wp\/v2\/tags?post=313"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}