CVE-2024-1110: Missing Authorization (CWE-862)
value: The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.
CWE description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
CVSS v3 base score: 5.3
Published: 2024-02-07T11:15Z
Repository: https://github.com/podlove/podlove-publisher
Language: PHP
Files changed: lib/modules/import_export/import/podcast_importer.php, lib/modules/import_export/import/tracking_importer.php, lib/modules/import_export/import_export.php, readme.txt
Commit date: 2024-02-04 21:11:18 +0100
Commit message: fix: add missing capability check and nonce validation to importer functions

Diff: diff --git a/lib/modules/import_export/import/podcast_importer.php b/lib/modules/import_export/import/podcast_importer.php
index 571d49023..381a896d7 100644
--- a/lib/modules/import_export/import/podcast_importer.php
+++ b/lib/modules/import_export/import/podcast_importer.php
@@ -28,10 +28,18 @@ class PodcastImporter
 
         if (!isset($_FILES['podlove_import'])) {
             return;
         }
 
+        if (!current_user_can('administrator')) {
+            return;
+        }
+
+        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import')) {
+            return;
+        }
+
         // allow xml+gz uploads
         add_filter('mime_types', function ($mimes) {
             $mimes['xml'] = 'application/xml';
             $mimes['gz'] = 'application/gzip';
 
diff --git a/lib/modules/import_export/import/tracking_importer.php b/lib/modules/import_export/import/tracking_importer.php
index b7c193a46..1070e7b29 100644
--- a/lib/modules/import_export/import/tracking_importer.php
+++ b/lib/modules/import_export/import/tracking_importer.php
@@ -22,10 +22,18 @@ class TrackingImporter
 
         if (!isset($_FILES['podlove_import_tracking'])) {
             return;
         }
 
+        if (!current_user_can('administrator')) {
+            return;
+        }
+
+        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import_tracking')) {
+            return;
+        }
+
         set_time_limit(10 * MINUTE_IN_SECONDS);
 
         add_filter('upload_mimes', function ($mimes_types) {
             $mimes_types['gz'] = 'application/x-gzip';
 
diff --git a/lib/modules/import_export/import_export.php b/lib/modules/import_export/import_export.php
index 1d9f7ebd6..7e8a81f3b 100644
--- a/lib/modules/import_export/import_export.php
+++ b/lib/modules/import_export/import_export.php
@@ -213,10 +213,11 @@ class Import_Export extends \Podlove\Modules\Base
 
 		<form method="POST" enctype="multipart/form-data">
 			(<span><?php echo self::get_maximum_upload_size_text(); ?></span>)
 			<input type="file" name="podlove_import"/> 
 			<input type="submit" value="<?php echo __('Import Podcast Data', 'podlove-podcasting-plugin-for-wordpress'); ?>" class="button" />
+			<?php wp_nonce_field('podlove_import', '_podlove_nonce'); ?>
 		</form>		
 		<?php
     }
 
     public function tools_tracking_import()
@@ -224,10 +225,11 @@ class Import_Export extends \Podlove\Modules\Base
         ?>
 		<form method="POST" enctype="multipart/form-data">
 			(<span><?php echo self::get_maximum_upload_size_text(); ?></span>)
 			<input type="file" name="podlove_import_tracking"/>
 			<input type="submit" value="<?php echo __('Import Tracking Data', 'podlove-podcasting-plugin-for-wordpress'); ?>" class="button" />
+			<?php wp_nonce_field('podlove_import_tracking', '_podlove_nonce'); ?>
 		</form>		
 		<?php
     }
 
     public static function get_maximum_upload_size_text()
diff --git a/readme.txt b/readme.txt
index a2fed6bd0..72377c86f 100644
--- a/readme.txt
+++ b/readme.txt
@@ -106,11 +106,14 @@ This product includes GeoLite2 data created by MaxMind, available from http://ww
 
 == Changelog ==
 
 = 4.0.12 =
 
+**Security**
+
 - fix SSRF vulnerability in Slacknotes module
+- add missing capability check and nonce validation to importer functions
 
 = 4.0.11 =
 
 - new: show admin notice when a database migration fails
 - fix bug where tracking data could be lost by disabling a media file checkbox

Fixed code:         if (!current_user_can('administrator')) {
            return;
        }

        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import')) {
            return;
        }

        if (!current_user_can('administrator')) {
            return;
        }

        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import_tracking')) {
            return;
        }

			<?php wp_nonce_field('podlove_import', '_podlove_nonce'); ?>
			<?php wp_nonce_field('podlove_import_tracking', '_podlove_nonce'); ?>
**Security**

- add missing capability check and nonce validation to importer functions