Exploitation Research Plan: CVE-2024-4766 (Easy Image Gallery <= 1.5.3)

1. Vulnerability Summary

The Easy Image Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to 1.5.3. The vulnerability exists because the plugin fails to sanitize and escape user-supplied input stored in post meta fields associated with its gallery functionality. Specifically, when a user with Contributor-level permissions or higher saves a post, they can inject malicious scripts into gallery-related metadata. These scripts are then executed in the context of any user (including Administrators) who views the post on the frontend or edits it in the backend.

2. Attack Vector Analysis

• Endpoint: wp-admin/post.php (Standard WordPress post update handler).
• Action: editpost.
• Vulnerable Parameters (inferred): easy_image_gallery_link_target, easy_image_gallery_custom_link, or internal meta fields used to store attributes for the [easy_image_gallery] shortcode.
• Authentication: Required (Contributor-level or higher).
• Preconditions: The plugin must be active, and a post containing (or intended to contain) a gallery must be edited.

3. Code Flow (Inferred)

1. Entry Point (Admin): A user with edit_posts capability (Contributor+) visits the post editor.
2. Meta Box Registration: The plugin registers a meta box using add_meta_box (likely in includes/admin/metabox.php or easy-image-gallery.php).
3. Data Processing (Save): When the post is saved, a hook for save_post (e.g., easy_image_gallery_save_post_meta) captures input from $_POST.
4. Insecure Storage: The code likely uses update_post_meta( $post_id, '_easy_image_gallery_...', $_POST['...'] ) without calling sanitize_text_field() or esc_attr().
5. Frontend Sink: When the post is rendered, the plugin retrieves meta via get_post_meta().
6. Unescaped Output: The values are echoed directly into the HTML (e.g., inside an <a> tag's target or href attribute) in the frontend gallery template or via the [easy_image_gallery] shortcode handler.

4. Nonce Acquisition Strategy

This is an authenticated exploit targeting the WordPress admin dashboard. The agent must obtain a valid WordPress core nonce for the editpost action.

1. Log in as a Contributor user.
2. Navigate to wp-admin/post-new.php to initiate a new post.
3. Extract Data: Use browser_eval to extract the post_ID and the _wpnonce from the page source.
   • post_ID is found in the hidden input name="post_ID".
   • _wpnonce is found in the hidden input name="_wpnonce".
4. Identify Meta Fields: Inspect the Easy Image Gallery meta box. Based on plugin structure, look for fields with names like easy_image_gallery_link_target.

5. Exploitation Strategy

1. Authentication: Login as a Contributor.
2. Initial Post Creation:
   • Navigate to wp-admin/post-new.php.
   • Capture post_ID and _wpnonce.
3. Inject Payload:
   • Perform an http_request (POST) to wp-admin/post.php.
   • Payload: "><script>alert(document.domain)</script>
   • Target Parameter: easy_image_gallery_link_target (common in this plugin for XSS).
   • Request Body:

     action=editpost
     post_ID=[CAPTURED_ID]
     _wpnonce=[CAPTURED_NONCE]
     post_title=Gallery Test
     content=[easy_image_gallery]
     easy_image_gallery_link_target="><script>alert(document.domain)</script>
     

4. Trigger Execution: Navigate to the frontend URL of the created post: /?p=[POST_ID].

6. Test Data Setup

1. User: Create a user with the Contributor role.
2. Plugin Configuration: Ensure "Easy Image Gallery" is active.
3. Post Content: A post must contain the shortcode [easy_image_gallery] to trigger the rendering logic that fetches the malicious meta.

7. Expected Results

• The POST request should return a 302 Redirect back to the post edit page (indicating success).
• When navigating to the frontend post URL, an alert box showing the document domain should appear.
• Inspection of the HTML source should show the script tag injected into the gallery's container or link attributes.

8. Verification Steps

1. WP-CLI Check: Verify the meta was saved without sanitization:

   wp post meta get [POST_ID] easy_image_gallery_link_target
   

2. Frontend Check: Use browser_navigate to the post and check for the presence of the script in the DOM:

   // browser_eval
   document.body.innerHTML.includes('<script>alert(document.domain)</script>')
   

9. Alternative Approaches

If easy_image_gallery_link_target is not the correct parameter:

• Check for Hidden Meta: Some versions store gallery image IDs in _easy_image_gallery. Try injecting into parameters that might be used as "Custom Link" attributes for individual images.
• Shortcode Attributes: If the plugin allows custom attributes in the shortcode that are saved to meta (e.g., through a "Settings" tab in the meta box), target those fields.
• Injected Payload Variation: If the sink is inside an attribute, use: x" onmouseover="alert(1)". If inside a URL, use: javascript:alert(1).