Stored DOM-Based XSS in NextGEN Gallery WordPress Plugin

Executive Summary

This vulnerability is a Stored DOM-Based Cross-Site Scripting (XSS) issue in the NextGEN Gallery WordPress plugin. It allows unauthenticated attackers to inject malicious scripts via the 'comment' parameter due to insufficient input sanitization and output escaping. The attack requires the site to use Shutter or Shutter Reloaded as the active lightbox and the injected comment must be approved through WordPress's moderation workflow before the payload executes for other visitors.

Useful 0 Not Useful 0

Detection Guidance

Check if the NextGEN Gallery plugin version is 4.5.4 or lower. Inspect WordPress comments for suspicious scripts in the 'comment' parameter. Enable WordPress comment moderation to review pending comments for injected payloads.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to inject malicious scripts into your website, which would execute when other users visit the affected pages. This could lead to theft of user sessions, defacement of your site, or spreading malware to your visitors. The impact depends on the privileges of the injected script and the site's configuration.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to non-compliance with GDPR or HIPAA if exploited, as it may result in unauthorized access to user data or exposure of sensitive information. GDPR requires protection against such attacks to ensure data integrity and confidentiality, while HIPAA mandates safeguards to prevent unauthorized access to protected health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update the NextGEN Gallery plugin to the latest version. Disable Shutter or Shutter Reloaded as the active lightbox if enabled. Review and approve comments manually before publishing to prevent malicious scripts from being rendered.

Useful 0 Not Useful 0