CVE-2024-25600: Bricks Builder RCE Vulnerability

CVE-2024-25600 Overview

CVE-2024-25600 is a critical code injection vulnerability affecting Bricks Builder, a popular WordPress theme builder developed by Codeer Limited. This improper control of code generation flaw enables unauthenticated attackers to execute arbitrary code on vulnerable WordPress installations running Bricks Builder versions up to and including 1.9.6.

The vulnerability allows remote attackers to achieve full server compromise without requiring any authentication, making it exceptionally dangerous for WordPress sites using the affected theme. Given the popularity of Bricks Builder in the WordPress ecosystem, this vulnerability presents a significant attack surface for threat actors targeting WordPress installations.

Critical Impact

Unauthenticated remote code execution allowing complete server takeover, data exfiltration, malware deployment, and use of compromised servers in botnet infrastructure.

Affected Products

• Bricks Builder WordPress Theme versions through 1.9.6
• WordPress installations utilizing vulnerable Bricks Builder versions
• Websites built using Bricks Builder page builder functionality

Discovery Timeline

• 2024-06-04 - CVE-2024-25600 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-25600

Vulnerability Analysis

This vulnerability falls under CWE-94 (Improper Control of Generation of Code), commonly known as Code Injection. The flaw exists in how Bricks Builder processes user-supplied input, failing to properly sanitize or validate data before incorporating it into dynamically generated code that is subsequently executed by the server.

The unauthenticated nature of this vulnerability is particularly concerning, as it requires no prior access or credentials to exploit. An attacker can remotely target any WordPress installation running a vulnerable version of Bricks Builder and achieve arbitrary code execution with the privileges of the web server process.

Successful exploitation grants attackers the ability to read and write files on the server, access the WordPress database including user credentials and sensitive data, install backdoors for persistent access, pivot to other systems on the network, or deploy cryptocurrency miners or other malware.

Root Cause

The root cause of CVE-2024-25600 lies in improper input validation and sanitization within the Bricks Builder theme. The application fails to adequately filter user-controlled input before passing it to code execution functions. This lack of proper input handling allows attackers to inject malicious code that is subsequently interpreted and executed by the PHP runtime.

The vulnerability specifically affects the code generation mechanisms within Bricks Builder where dynamic content rendering occurs, allowing arbitrary PHP code to be injected and executed in the context of the WordPress application.

Attack Vector

The attack vector is network-based, requiring no authentication, no user interaction, and presenting low attack complexity. An attacker can craft malicious HTTP requests targeting the vulnerable endpoint in Bricks Builder, injecting PHP code that will be executed server-side.

The exploitation typically involves identifying WordPress installations using Bricks Builder through fingerprinting techniques, crafting a malicious request containing injected PHP code, and sending the request to the vulnerable endpoint to achieve code execution.

Proof-of-concept exploits are publicly available, as documented in the GitHub PoC Repository by Chocapikk and the GitHub Exploit Repository by K3ysTr0K3R. The existence of public exploits significantly increases the risk of active exploitation in the wild.

Detection Methods for CVE-2024-25600

Indicators of Compromise

• Unusual PHP files appearing in WordPress directories, particularly in /wp-content/themes/bricks/ or /wp-content/uploads/
• Unexpected outbound network connections from the web server
• Modified or newly created files with obfuscated PHP code
• Suspicious entries in web server access logs showing malformed or encoded POST requests to Bricks Builder endpoints
• Unexplained processes running under the web server user account

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block code injection patterns in HTTP requests
• Implement file integrity monitoring on WordPress installation directories to detect unauthorized file modifications
• Monitor web server logs for POST requests containing PHP code patterns or suspicious encoded payloads
• Use endpoint detection solutions like SentinelOne to identify and block malicious code execution attempts
• Scan WordPress installations regularly with security plugins to identify vulnerable theme versions

Monitoring Recommendations

• Enable detailed logging for all HTTP requests to WordPress installations, particularly POST requests
• Configure alerting for any new PHP files created outside of normal update processes
• Monitor for process spawning from web server processes that may indicate successful exploitation
• Implement network traffic analysis to detect command-and-control communications from compromised servers
• Regularly audit WordPress theme and plugin versions against known vulnerability databases

How to Mitigate CVE-2024-25600

Immediate Actions Required

• Update Bricks Builder theme immediately to version 1.9.6.1 or later, which contains the security patch
• If immediate updating is not possible, consider temporarily disabling or removing the Bricks Builder theme
• Audit existing WordPress installations for signs of compromise before and after patching
• Review web server access logs for evidence of exploitation attempts
• Reset all WordPress user passwords and database credentials if compromise is suspected

Patch Information

Codeer Limited has released a patched version of Bricks Builder that addresses this vulnerability. Administrators should update to version 1.9.6.1 or the latest available version through the WordPress theme management interface or by downloading directly from the vendor.

Detailed patch information is available from Patchstack's Critical RCE Patch Article and the Patchstack Vulnerability Database Entry.

Additional technical details about the vulnerability can be found in the Snicco Vulnerability Disclosure.

Workarounds

• If patching is delayed, implement WAF rules to block requests containing PHP code injection patterns targeting Bricks Builder endpoints
• Restrict access to the WordPress admin interface to trusted IP addresses only
• Consider temporarily switching to an alternative theme if Bricks Builder cannot be immediately updated
• Deploy additional server-level protections such as disable_functions in php.ini to limit the impact of potential code execution
• Implement network segmentation to limit lateral movement potential from compromised web servers

# Example WAF rule to help mitigate until patched (ModSecurity format)
# This is a defense-in-depth measure and should not replace patching
SecRule REQUEST_BODY "@contains eval(" "id:1001,phase:2,deny,status:403,msg:'Potential PHP code injection blocked'"
SecRule REQUEST_BODY "@rx \$_(?:GET|POST|REQUEST|COOKIE)" "id:1002,phase:2,deny,status:403,msg:'Potential PHP superglobal injection blocked'"