CVE-2024-12114

Executive Summary

CVE-2024-12114 is an Insecure Direct Object Reference (IDOR) vulnerability found in the FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress, affecting all versions up to and including 2.4.29. The flaw resides in the foogallery_attachment_modal_save AJAX action, where a user-controlled key (img_id) is not properly validated. This allows authenticated attackers with granted access (e.g., Gallery Creator role) to update arbitrary post and page content. The vulnerability is rated with a CVSS score of 4.3 (Medium) and has a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept or exploit code is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user with granted access)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered medium due to the requirement for authentication and the limited impact on integrity. However, the ability to modify arbitrary post/page content could be leveraged for defacement or phishing attacks.

Deep Dive & Mechanics

The vulnerability is an Insecure Direct Object Reference (CWE-639) in the FooGallery plugin. The foogallery_attachment_modal_save AJAX action is intended to save attachment metadata, but it fails to verify that the user has permission to modify the referenced post or page. The img_id parameter is used to identify the attachment, but the plugin does not check if the authenticated user is authorized to update the associated post. This allows an attacker with the Gallery Creator role (or higher) to modify content they should not have access to.

The attack flow:

1. An authenticated user with the Gallery Creator role sends a POST request to /wp-admin/admin-ajax.php with action foogallery_attachment_modal_save.
2. The request includes a crafted img_id pointing to an attachment belonging to a post/page the user does not own.
3. The plugin processes the request without verifying ownership, allowing the attacker to update the post/page content.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.29):

add_action('wp_ajax_foogallery_attachment_modal_save', 'foogallery_attachment_modal_save');
function foogallery_attachment_modal_save() {
    $img_id = intval($_POST['img_id']);
    // Missing capability check for the post/page associated with the attachment
    update_post_meta($img_id, '_foogallery_attachment_data', $_POST['data']);
    wp_die();
}

Patched Code (Hypothetical):

add_action('wp_ajax_foogallery_attachment_modal_save', 'foogallery_attachment_modal_save');
function foogallery_attachment_modal_save() {
    $img_id = intval($_POST['img_id']);
    $attachment = get_post($img_id);
    if (!$attachment || !current_user_can('edit_post', $attachment->post_parent)) {
        wp_die('Unauthorized');
    }
    update_post_meta($img_id, '_foogallery_attachment_data', $_POST['data']);
    wp_die();
}

The patched version adds a capability check using current_user_can('edit_post', $attachment->post_parent) to ensure the user has permission to edit the parent post.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker needs:

• A WordPress site with FooGallery plugin version <= 2.4.29.
• An authenticated user account with the Gallery Creator role (or higher).

Exploitation Steps:

1. Log in as a user with Gallery Creator role.
2. Identify a target post/page ID (e.g., via browsing or enumeration).
3. Find an attachment ID associated with that post (e.g., via media library).
4. Send a crafted AJAX request:

curl -X POST http://target.com/wp-admin/admin-ajax.php \
  -d "action=foogallery_attachment_modal_save&img_id=ATTACHMENT_ID&data=malicious_content"

5. The post/page content is updated with the attacker's data.

Blue Team

Detection:

• Monitor AJAX requests to admin-ajax.php with action foogallery_attachment_modal_save.
• Look for unusual img_id values that do not correspond to attachments owned by the user.
• Alert on multiple rapid requests from the same user to different attachment IDs.

Hunting:

• Review WordPress audit logs for unauthorized post/page modifications.
• Check for unexpected changes in post content, especially from users with lower privileges.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=foogallery_attachment_modal_save and suspicious img_id values.
• File: Modified post/page content in the WordPress database (wp_posts table).
• Log: WordPress debug log entries showing unauthorized AJAX requests.
• User: Accounts with Gallery Creator role making unusual AJAX calls.

Detection Engineering

YARA Rule

rule CVE_2024_12114_FooGallery_IDOR {
    meta:
        description = "Detects exploitation attempts of CVE-2024-12114 in FooGallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-12114"
    strings:
        $ajax_action = "foogallery_attachment_modal_save"
        $img_id_param = "img_id"
    condition:
        $ajax_action and $img_id_param
}

Sigma Rule

title: FooGallery IDOR Exploitation Attempt
id: 8a3f2c1e-5b7d-4a9f-8c6e-2d1f3a4b5c6d
status: experimental
description: Detects attempts to exploit CVE-2024-12114 in FooGallery plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=foogallery_attachment_modal_save'
    condition: selection
falsepositives:
    - Legitimate plugin usage by authorized users
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-12114 FooGallery IDOR Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=foogallery_attachment_modal_save"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the FooGallery plugin if not essential, or restrict the Gallery Creator role to trusted users only.
2. Short-term: Apply the vendor patch when available. Monitor the plugin's official page for updates.
3. Long-term: Implement a Web Application Firewall (WAF) rule to block suspicious AJAX requests. Enforce least privilege for user roles.
4. Detection: Deploy the provided YARA, Sigma, and Suricata rules to monitor for exploitation attempts.

Valters IT
Securing Digital Frontiers