CVE-2015-10116: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2023-06-06T01:15Z
Repository: https://github.com/wp-plugins/favicon-by-realfavicongenerator
Language: PHP
Files changed: README.txt, admin/class-favicon-by-realfavicongenerator-admin.php, admin/views/appearance.php, favicon-by-realfavicongenerator.php
Commit date: 2015-04-01 11:55:13 +0000
Commit message: XSS vulnerability fixed, reported by Kacper Szurek

git-svn-id: https://plugins.svn.wordpress.org/favicon-by-realfavicongenerator/trunk@1125286 b8457f37-d9ea-0310-8a92-e5e31aec5664

Diff: diff --git a/README.txt b/README.txt
index 1106eba..3e02895 100755
--- a/README.txt
+++ b/README.txt
@@ -1,15 +1,15 @@
 === Favicon by RealFaviconGenerator ===
 Contributors: phbernard
 Tags: favicon, apple-touch-icon, realfavicongenerator
 Requires at least: 3.5
 Tested up to: 4.1.1
-Stable tag: 1.2.12
+Stable tag: 1.2.13
 License: GPLv2
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
-Create and install your favicon for all platforms: PC/Mac of course, but also iPhone/iPad, Android devices, Windows 8 tablets...
+Create and install your favicon for all platforms: PC/Mac, iPhone/iPad, Android devices, Windows 8 tablets...
 
 == Description ==
 
 Generate and setup a favicon for desktop browsers, iPhone/iPad, Android devices, Windows 8 tablets and more. In a matter of seconds, design an icon that looks great on all major platforms.
 
@@ -70,10 +70,14 @@ where you can design your favicon: adding a background to your iOS picture, usin
 This screen presents you a preview of the favicon you various platforms, so you know how your blog looks like on various platforms.
 5. You can also trigger RealFaviconGenerator's favicon checker, to make sure your favicon is correctly setup.
 
 == Changelog ==
 
+= 1.2.13 =
+
+- XSS vulnerability fixed, reported by [Kacper Szurek](http://security.szurek.pl/)
+
 = 1.2.12 =
 
 - Performance improvements: favicon update checking is now done in the Admin section (not the Public section), locales are not loaded in the Public section anymore.
 - Take advantage of the Rewrite API (when available) to make the files appear to be in the root directory. So http://example.com/favicon.ico works (eg. when requested by Yandex).
 - nl/NL translation added, thanks to Axel Vanderhaeghen.
diff --git a/admin/class-favicon-by-realfavicongenerator-admin.php b/admin/class-favicon-by-realfavicongenerator-admin.php
index e5b6df3..98782ba 100755
--- a/admin/class-favicon-by-realfavicongenerator-admin.php
+++ b/admin/class-favicon-by-realfavicongenerator-admin.php
@@ -7,10 +7,11 @@ require_once plugin_dir_path( __FILE__ ) . 'class-favicon-by-realfavicongenerato
 class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenerator_Common {
 
 	const DISMISS_UPDATE_NOTIICATION = 'fbrfg_dismiss_update_notification';
 	const DISMISS_UPDATE_ALL_UPDATE_NOTIICATIONS = 'fbrfg_dismiss_all_update_notifications';
 	const SETTINGS_FORM = 'fbrfg_settings_form';
+	const NONCE_ACTION_NAME = 'favicon_generation';
 
 	protected static $instance = null;
 
 	private function __construct() {
 		add_action( 'init', array( $this, 'load_plugin_textdomain' ) );
@@ -123,10 +124,13 @@ class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenera
 		else {
 			// No new favicon, simply display the settings page
 			$new_favicon_params_url = NULL;
 		}
 
+		// Nonce
+		$nonce = wp_create_nonce( NONCE_ACTION_NAME );
+
 		// External files
 		wp_enqueue_script( 'jquery' );
 		wp_enqueue_script( 'jquery-ui' );
 		wp_enqueue_script( 'jquery-effects-pulsate' );
 		wp_enqueue_media();
@@ -159,32 +163,43 @@ class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenera
 
 			$result = $this->download_result_json( $url );
 
 			$response = new Favicon_By_RealFaviconGenerator_Api_Response( $result );
 
-			$zip_path = Favicon_By_RealFaviconGenerator_Common::get_tmp_dir();
-			if ( ! file_exists( $zip_path ) ) {
-				mkdir( $zip_path, 0755, true );
+			if ( ! wp_verify_nonce( $response->getCustomParameter(), NONCE_ACTION_NAME ) ) {
+				// Attack in progress?
+?>
+{
+	"status": "error",
+	"message": "<?php _e( 'Nonce was not recognized. This case is supposed to happen only in case of XSS attack. If you feel like something is wrong, please <a href=\"mailto:contact@realfavicongenerator.net\">contact us</a>.', FBRFG_PLUGIN_SLUG ) ?>"
+}
+<?php
 			}
-			$response->downloadAndUnpack( $zip_path );
+			else {
+				$zip_path = Favicon_By_RealFaviconGenerator_Common::get_tmp_dir();
+				if ( ! file_exists( $zip_path ) ) {
+					mkdir( $zip_path, 0755, true );
+				}
+				$response->downloadAndUnpack( $zip_path );
 
-			$this->store_pictures( $response );
+				$this->store_pictures( $response );
 
-			$this->store_preview( $response->getPreviewPath() );
+				$this->store_preview( $response->getPreviewPath() );
 
-			Favicon_By_RealFaviconGenerator_Common::remove_directory( $zip_path );
+				Favicon_By_RealFaviconGenerator_Common::remove_directory( $zip_path );
 
-			update_option( Favicon_By_RealFaviconGenerator_Common::OPTION_HTML_CODE, $response->getHtmlCode() );
-			
-			$this->set_favicon_configured( true, $response->isFilesInRoot(), $response->getVersion() );
+				update_option( Favicon_By_RealFaviconGenerator_Common::OPTION_HTML_CODE, $response->getHtmlCode() );
+				
+				$this->set_favicon_configured( true, $response->isFilesInRoot(), $response->getVersion() );
 ?>
 {
 	"status": "success",
 	"preview_url": <?php echo json_encode( $this->get_preview_url() ) ?>,
 	"favicon_in_root": <?php echo json_encode( $this->is_favicon_in_root() ) ?>
 }
 <?php
+			}
 		}
 		catch(Exception $e) {
 ?>
 {
 	"status": "error",
diff --git a/admin/views/appearance.php b/admin/views/appearance.php
index 84feaf6..87cf395 100755
--- a/admin/views/appearance.php
+++ b/admin/views/appearance.php
@@ -182,10 +182,11 @@
 		params.favicon_generation.callback.url = "<?php echo admin_url('themes.php?page=' . ( ( isset( $_REQUEST['page'] ) ) 
 			? $_REQUEST['page']
 			: 'favicon-by-realfavicongenerator/admin/class-favicon-by-realfavicongenerator-admin.phpfavicon_appearance_menu' ) ) ?>";
 		params.favicon_generation.callback.short_url = 'true';
 		params.favicon_generation.callback.path_only = 'true';
+		params.favicon_generation.callback.custom_parameter = "<?php echo $nonce ?>";
 
 		return params;
 	}
 
 	var pictureContent = null;
diff --git a/favicon-by-realfavicongenerator.php b/favicon-by-realfavicongenerator.php
index 483b3a1..0b14e0d 100755
--- a/favicon-by-realfavicongenerator.php
+++ b/favicon-by-realfavicongenerator.php
@@ -10,11 +10,11 @@
  *
  * @wordpress-plugin
  * Plugin Name:       Favicon by RealFaviconGenerator
  * Plugin URI:        http://realfavicongenerator.net/extensions/wordpress
  * Description:       Create and install your favicon for all platforms: PC/Mac of course, but also iPhone/iPad, Android devices, Windows 8 tablets, etc. 
- * Version:           1.2.12
+ * Version:           1.2.13
  * Author:            Philippe Bernard
  * Author URI:        http://realfavicongenerator.net/
  * License:           GPLv2
  * License URI:       http://www.gnu.org/licenses/gpl-2.0.html
  */

Vulnerable code: Stable tag: 1.2.12
Create and install your favicon for all platforms: PC/Mac of course, but also iPhone/iPad, Android devices, Windows 8 tablets...
			$zip_path = Favicon_By_RealFaviconGenerator_Common::get_tmp_dir();
			if ( ! file_exists( $zip_path ) ) {
				mkdir( $zip_path, 0755, true );
			$response->downloadAndUnpack( $zip_path );
			$this->store_pictures( $response );
			$this->store_preview( $response->getPreviewPath() );
			Favicon_By_RealFaviconGenerator_Common::remove_directory( $zip_path );
			update_option( Favicon_By_RealFaviconGenerator_Common::OPTION_HTML_CODE, $response->getHtmlCode() );
			
			$this->set_favicon_configured( true, $response->isFilesInRoot(), $response->getVersion() );
 * Version:           1.2.12
Fixed code: Stable tag: 1.2.13
Create and install your favicon for all platforms: PC/Mac, iPhone/iPad, Android devices, Windows 8 tablets...
= 1.2.13 =

- XSS vulnerability fixed, reported by [Kacper Szurek](http://security.szurek.pl/)

	const NONCE_ACTION_NAME = 'favicon_generation';
		// Nonce
		$nonce = wp_create_nonce( NONCE_ACTION_NAME );

			if ( ! wp_verify_nonce( $response->getCustomParameter(), NONCE_ACTION_NAME ) ) {
				// Attack in progress?
?>
{
	"status": "error",
	"message": "<?php _e( 'Nonce was not recognized. This case is supposed to happen only in case of XSS attack. If you feel like something is wrong, please <a href=\"mailto:contact@realfavicongenerator.net\">contact us</a>.', FBRFG_PLUGIN_SLUG ) ?>"
}
<?php
			else {
				$zip_path = Favicon_By_RealFaviconGenerator_Common::get_tmp_dir();
				if ( ! file_exists( $zip_path ) ) {
					mkdir( $zip_path, 0755, true );
				}
				$response->downloadAndUnpack( $zip_path );
				$this->store_pictures( $response );
				$this->store_preview( $response->getPreviewPath() );
				Favicon_By_RealFaviconGenerator_Common::remove_directory( $zip_path );
				update_option( Favicon_By_RealFaviconGenerator_Common::OPTION_HTML_CODE, $response->getHtmlCode() );
				
				$this->set_favicon_configured( true, $response->isFilesInRoot(), $response->getVersion() );
			}
		params.favicon_generation.callback.custom_parameter = "<?php echo $nonce ?>";
 * Version:           1.2.13