CVE-2023-6947

Executive Summary

CVE-2023-6947 is a Directory Traversal vulnerability in the FooGallery WordPress plugin, affecting all versions up to and including 2.4.26. This flaw allows authenticated attackers with at least contributor-level permissions to read arbitrary directories on the server, potentially exposing sensitive information such as folder structures, configuration files, or other application data. The vulnerability is classified as high severity (CVSS 7.7) due to its low attack complexity and potential for information disclosure. No public proof-of-concept or patch details are currently available, making this a critical issue for affected WordPress sites.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin ecosystem, not in a package manager like NPM or PyPI. However, the plugin is distributed via the official WordPress plugin repository, and administrators should verify the integrity of their plugin files against known hashes. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 7.7 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Contributor or higher)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is elevated due to the low barrier to entry (authenticated contributor) and the potential for sensitive data exposure, including server directory structures that could aid further attacks.

Deep Dive & Mechanics

The vulnerability exists in the FooGallery plugin's handling of file paths when processing gallery-related requests. Specifically, the plugin fails to properly sanitize user-supplied input used to construct directory paths, allowing an attacker to traverse outside the intended directory using ../ sequences. This is a classic Path Traversal (CWE-22) flaw.

The attack likely occurs through a parameter that specifies a directory or file path for gallery operations (e.g., listing images or templates). By injecting path traversal sequences, an attacker can read arbitrary directories, such as /etc/, /var/www/html/wp-content/, or other sensitive locations. The plugin does not validate that the resolved path stays within the allowed base directory.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is hypothesized based on common WordPress plugin implementations:

Vulnerable Code (hypothetical):

$directory = $_GET['gallery_dir'];
$files = scandir( WP_CONTENT_DIR . '/galleries/' . $directory );

Patched Code (hypothetical):

$directory = basename( realpath( $_GET['gallery_dir'] ) );
if ( strpos( $directory, '..' ) !== false ) {
    wp_die( 'Invalid directory' );
}
$files = scandir( WP_CONTENT_DIR . '/galleries/' . $directory );

The patched version uses realpath() to resolve the path and then checks for traversal sequences, ensuring the directory stays within the allowed base.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with FooGallery <= 2.4.26
• Valid user account with Contributor role or higher

Exploitation Steps:

1. Log in to WordPress as a Contributor.
2. Identify the vulnerable endpoint (likely an AJAX action or admin page that accepts a directory parameter).
3. Craft a request with path traversal payload:

   GET /wp-admin/admin-ajax.php?action=foogallery_list&dir=../../../etc
   

4. The server returns the contents of /etc/ directory, revealing folder structure and potentially sensitive files.

Example cURL command:

curl -u "attacker:password" "http://target/wp-admin/admin-ajax.php?action=foogallery_list&dir=../../../etc"

Blue Team

Detection:

• Monitor for unusual directory traversal patterns in HTTP requests, especially ../ sequences in parameters.
• Alert on authenticated users (Contributor or higher) accessing non-standard directories via plugin endpoints.
• Review server logs for scandir() or readdir() calls with unexpected paths.

Hunting:

• Search for requests to admin-ajax.php with parameters containing dir= or path= and ../ sequences.
• Correlate with user roles to identify low-privilege accounts attempting directory traversal.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing ../ in parameters like dir, path, or folder to /wp-admin/admin-ajax.php or similar endpoints.
• File System: Unexpected directory listings in web server logs (e.g., /etc, /var/log).
• User Activity: Contributor or Author accounts making unusual AJAX requests to plugin-specific actions.
• Logs: PHP error logs showing scandir() failures or warnings about invalid paths.

Detection Engineering

YARA Rule

rule CVE_2023_6947_FooGallery_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against FooGallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2023-6947"
    strings:
        $traversal = /(\.\.\/){2,}/ nocase
        $param = /(dir|path|folder)=/ nocase
        $endpoint = /admin-ajax\.php/ nocase
    condition:
        all of them
}

Sigma Rule

title: FooGallery Directory Traversal Attempt
id: 8f4a3b2c-1d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects path traversal attempts against FooGallery plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'admin-ajax.php'
            - 'action=foogallery'
        cs-uri-query|re: '(\.\.\/){2,}'
    condition: selection
falsepositives:
    - Legitimate use of directory parameters in admin functions
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-6947 FooGallery Directory Traversal Attempt"; flow:to_server,established; content:"admin-ajax.php"; http_uri; content:"action=foogallery"; http_uri; pcre:"/(\.\.\/){2,}/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the FooGallery plugin until a patch is released.
2. Restrict user roles – Remove Contributor and Author roles if not needed, or limit their capabilities.
3. Web Application Firewall (WAF) – Deploy rules to block ../ sequences in plugin-specific parameters.

Long-term Fix:

• Monitor the FooGallery plugin repository for an official patch (version > 2.4.26).
• Implement input validation and path sanitization in custom code if using similar functionality.

Workaround:

• Use a security plugin (e.g., Wordfence) to block directory traversal patterns.
• Apply virtual patching via WAF or server-level mod_rewrite rules.

Report generated by Valters IT DevSecOps Intelligence