CVE-2021-38346: Brizy <= 2.3.11 Authenticated Unrestricted File Upload and Path Traversal
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizycreateblockscreenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal, and the file contents were populated via the ibsf parameter, which would be base64-decoded and written to the file. While the plugin added a .jpg extension to all uploaded filenames, a double extension attack was still possible, e.g. a file named shell.php would be saved as shell.php.jpg, and would be executable on a number of common configurations.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Brizy Page Builder pluginto a version that resolves this vulnerability.Fixed in 2.3.11 - Compensating control
Block or restrict access to the Brizy Page Builder AJAX action brizy_create_block_screenshot so only authorized/required users can invoke it, and prevent uploading files to arbitrary server locations.
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2021-38346.
What is the title of the vulnerability?
The title of the vulnerability is The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executab…
What is the description of the vulnerability?
The Brizy Page Builder plugin <= 2.3.11 for WordPress allowed authenticated users to upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action. The file would be named using the id parameter, which could be prepended with "../" to perform directory traversal.
What is the affected software?
The affected software is Brizy Page Builder plugin version up to 2.3.11 for WordPress.
What is the severity of the vulnerability?
The severity of the vulnerability is high with a CVSS score of 8.8.
How can the vulnerability be exploited?
Authenticated users can upload executable files to a location of their choice using the brizy_create_block_screenshot AJAX action in the affected Brizy Page Builder plugin.
Is there a fix available for the vulnerability?
Yes, updating the Brizy Page Builder plugin to version 2.3.12 or later will fix the vulnerability.
Where can I find more information about the vulnerability?
You can find more information about the vulnerability at the following link: https://www.wordfence.com/blog/2021/10/multiple-vulnerabilities-in-brizy-page-builder-plugin-allow-site-takeover/
What are the related CWE IDs for the vulnerability?
The related CWE IDs for the vulnerability are CWE-22, CWE-434, and CWE-79.