CVE-2022-4633: Cross-Site Request Forgery (CSRF) (CWE-352)
value: A vulnerability was found in Auto Upload Images up to 3.3.0 and classified as problematic. Affected by this issue is some unknown functionality of the file src/setting-page.php of the component Settings Handler. The manipulation leads to cross-site request forgery. The attack may be launched remotely. Upgrading to version 3.3.1 is able to address this issue. The name of the patch is 895770ee93887ec78429c78ffdfb865bee6f9436. It is recommended to upgrade the affected component. VDB-216482 is the identifier assigned to this vulnerability.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 8.8
Published: 2022-12-21T19:15Z
Repository: https://github.com/airani/wp-auto-upload
Language: PHP
Files changed: src/WpAutoUpload.php, src/setting-page.php
Commit date: 2022-11-28 14:43:56 +0330
Commit message: fix security vulnerability protecting settings form from xss and csrf attacks

Diff: diff --git a/src/WpAutoUpload.php b/src/WpAutoUpload.php
index 1867aac..0b326aa 100644
--- a/src/WpAutoUpload.php
+++ b/src/WpAutoUpload.php
@@ -191,15 +191,15 @@ class WpAutoUpload
     /**
      * Settings page contents
      */
     public function settingPage()
     {
-        if (isset($_POST['submit'])) {
+        if (isset($_POST['submit']) && check_admin_referer('aui_settings')) {
             $fields = array('base_url', 'image_name', 'alt_name', 'exclude_urls', 'max_width', 'max_height', 'exclude_post_types');
             foreach ($fields as $field) {
                 if (array_key_exists($field, $_POST) && $_POST[$field]) {
-                    static::$_options[$field] = $_POST[$field];
+                    static::$_options[$field] = esc_attr($_POST[$field]);
                 }
             }
             update_option(self::WP_OPTIONS_KEY, static::$_options);
             $message = __('Settings Saved.', 'auto-upload-images');
         }
diff --git a/src/setting-page.php b/src/setting-page.php
index ead7e4f..18adde4 100644
--- a/src/setting-page.php
+++ b/src/setting-page.php
@@ -12,30 +12,31 @@
     <div id="poststuff">
         <div id="post-body" class="metabox-holder columns-2">
             <div id="post-body-content" style="position: relative">
                 <div class="stuffbox" style="padding: 0 20px">
                     <form method="POST">
+                        <?php echo wp_nonce_field('aui_settings'); ?>
                         <table class="form-table">
                             <tr valign="top">
                                 <th scope="row">
                                     <label for="base_url">
                                         <?php _e('Base URL:', 'auto-upload-images'); ?>
                                     </label>
                                 </th>
                                 <td>
-                                    <input type="text" name="base_url" value="<?php echo self::getOption('base_url'); ?>" class="regular-text" dir="ltr" />
+                                    <input type="text" name="base_url" value="<?php echo esc_attr(self::getOption('base_url')); ?>" class="regular-text" dir="ltr" />
                                     <p class="description"><?php _e('If you need to choose a new base URL for the images that will be automatically uploaded. Ex:', 'auto-upload-images'); ?> <code>https://irani.im</code>, <code>https://cdn.irani.im</code>, <code>/</code></p>
                                 </td>
                             </tr>
                             <tr valign="top">
                                 <th scope="row">
                                     <label for="image_name">
                                         <?php _e('Image Name:', 'auto-upload-images'); ?>
                                     </label>
                                 </th>
                                 <td>
-                                    <input type="text" name="image_name" value="<?php echo self::getOption('image_name'); ?>" class="regular-text" dir="ltr" />
+                                    <input type="text" name="image_name" value="<?php echo esc_attr(self::getOption('image_name')); ?>" class="regular-text" dir="ltr" />
                                     <p class="description">
                                         <?php printf(__('Choose a custom filename for the new images will be uploaded. You can also use these shortcodes %s.', 'auto-upload-images'), '<code dir="ltr">%filename%</code>, <code dir="ltr">%image_alt%</code>, <code dir="ltr">%url%</code>, <code dir="ltr">%date%</code>, <code dir="ltr">%year%</code>, <code dir="ltr">%month%</code>, <code dir="ltr">%day%</code>, <code dir="ltr">%random%</code>, <code dir="ltr">%timestamp%</code>, <code dir="ltr">%postname%</code>, <code dir="ltr">%post_id%</code>') ?>
                                     </p>
                                 </td>
                             </tr>
@@ -44,11 +45,11 @@
                                     <label for="alt_name">
                                         <?php _e('Alt Name:', 'auto-upload-images'); ?>
                                     </label>
                                 </th>
                                 <td>
-                                    <input type="text" name="alt_name" value="<?php echo self::getOption('alt_name'); ?>" class="regular-text" dir="ltr" />
+                                    <input type="text" name="alt_name" value="<?php echo esc_attr(self::getOption('alt_name')); ?>" class="regular-text" dir="ltr" />
                                     <p class="description">
                                         <?php printf(__('Choose a custom alt name for the new images will be uploaded. You can also use these shortcodes %s.', 'auto-upload-images'), '<code dir="ltr">%filename%</code>, <code dir="ltr">%image_alt%</code>, <code dir="ltr">%url%</code>, <code dir="ltr">%date%</code>, <code dir="ltr">%year%</code>, <code dir="ltr">%month%</code>, <code dir="ltr">%day%</code>, <code dir="ltr">%random%</code>, <code dir="ltr">%timestamp%</code>, <code dir="ltr">%postname%</code>, <code dir="ltr">%post_id%</code>') ?>
                                     </p>
                                 </td>
                             </tr>
@@ -61,13 +62,13 @@
                                         <small style="color:#6d6d6d;"><?php _e('(Inactive)', 'auto-upload-images') ?></small>
                                         <?php endif; ?>
                                     </th>
                                     <td>
                                         <label for="max_width"><?php _e('Max Width', 'auto-upload-images'); ?></label>
-                                        <input name="max_width" type="number" step="5" min="0" id="max_width" placeholder="600" class="small-text" value="<?php echo self::getOption('max_width'); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
+                                        <input name="max_width" type="number" step="5" min="0" id="max_width" placeholder="600" class="small-text" value="<?php echo esc_attr(self::getOption('max_width')); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
                                         <label for="max_height"><?php _e('Max Height', 'auto-upload-images'); ?></label>
-                                        <input name="max_height" type="number" step="5" min="0" id="max_height" placeholder="400" class="small-text" value="<?php echo self::getOption('max_height'); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
+                                        <input name="max_height" type="number" step="5" min="0" id="max_height" placeholder="400" class="small-text" value="<?php echo esc_attr(self::getOption('max_height')); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
                                         <p class="description"><?php _e('You can choose max width and height for images uploaded by this plugin on your site. If you leave empty each one of fields by default use the original size of the image.', 'auto-upload-images'); ?></p>
                                         <?php if (!$editor_supports) : ?>
                                         <p style="color:#535353;font-weight: bold;"><?php _e('To activate this feature please enable Gd or Imagick extensions of PHP.', 'auto-upload-images') ?></p>
                                         <?php endif; ?>
                                     </td>
@@ -82,11 +83,11 @@
                                 <td>
                                     <p>
                                         <?php $excludePostTypes = self::getOption('exclude_post_types'); ?>
                                         <?php foreach (get_post_types() as $post_type): ?>
                                             <label>
-                                                <input type="checkbox" name="exclude_post_types[]" value="<?php echo $post_type ?>" <?php echo is_array($excludePostTypes) && in_array($post_type, $excludePostTypes, true) ? 'checked' : ''; ?>> <?php echo $post_type ?>
+                                                <input type="checkbox" name="exclude_post_types[]" value="<?php echo esc_attr($post_type) ?>" <?php echo is_array($excludePostTypes) && in_array($post_type, $excludePostTypes, true) ? 'checked' : ''; ?>> <?php echo esc_attr($post_type) ?>
                                                 <br>
                                             </label>
                                         <?php endforeach; ?>
                                     </p>
                                     <p class="description"><?php _e('Select the Post Types that you want exclude from automatic uploading', 'auto-upload-images'); ?></p>
@@ -98,11 +99,11 @@
                                         <?php _e('Exclude Domains:', 'auto-upload-images'); ?>
                                     </label>
                                 </th>
                                 <td>
                                     <p><?php _e('Enter the domains you wish to be excluded from uploading images: (One domain per line)', 'auto-upload-images'); ?></p>
-                                    <p><textarea name="exclude_urls" rows="10" cols="50" id="exclude_urls" class="large-text code" placeholder="https://irani.im"><?php echo self::getOption('exclude_urls'); ?></textarea></p>
+                                    <p><textarea name="exclude_urls" rows="10" cols="50" id="exclude_urls" class="large-text code" placeholder="https://irani.im"><?php echo esc_textarea(self::getOption('exclude_urls')); ?></textarea></p>
                                 </td>
                             </tr>
                         </table>
                         <p class="submit">
                             <?php submit_button(null, 'primary', 'submit', false); ?>

Vulnerable code:         if (isset($_POST['submit'])) {
                    static::$_options[$field] = $_POST[$field];
                                    <input type="text" name="base_url" value="<?php echo self::getOption('base_url'); ?>" class="regular-text" dir="ltr" />
                                    <input type="text" name="image_name" value="<?php echo self::getOption('image_name'); ?>" class="regular-text" dir="ltr" />
                                    <input type="text" name="alt_name" value="<?php echo self::getOption('alt_name'); ?>" class="regular-text" dir="ltr" />
                                        <input name="max_width" type="number" step="5" min="0" id="max_width" placeholder="600" class="small-text" value="<?php echo self::getOption('max_width'); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
                                        <input name="max_height" type="number" step="5" min="0" id="max_height" placeholder="400" class="small-text" value="<?php echo self::getOption('max_height'); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
                                                <input type="checkbox" name="exclude_post_types[]" value="<?php echo $post_type ?>" <?php echo is_array($excludePostTypes) && in_array($post_type, $excludePostTypes, true) ? 'checked' : ''; ?>> <?php echo $post_type ?>
                                    <p><textarea name="exclude_urls" rows="10" cols="50" id="exclude_urls" class="large-text code" placeholder="https://irani.im"><?php echo self::getOption('exclude_urls'); ?></textarea></p>
Fixed code:         if (isset($_POST['submit']) && check_admin_referer('aui_settings')) {
                    static::$_options[$field] = esc_attr($_POST[$field]);
                        <?php echo wp_nonce_field('aui_settings'); ?>
                                    <input type="text" name="base_url" value="<?php echo esc_attr(self::getOption('base_url')); ?>" class="regular-text" dir="ltr" />
                                    <input type="text" name="image_name" value="<?php echo esc_attr(self::getOption('image_name')); ?>" class="regular-text" dir="ltr" />
                                    <input type="text" name="alt_name" value="<?php echo esc_attr(self::getOption('alt_name')); ?>" class="regular-text" dir="ltr" />
                                        <input name="max_width" type="number" step="5" min="0" id="max_width" placeholder="600" class="small-text" value="<?php echo esc_attr(self::getOption('max_width')); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
                                        <input name="max_height" type="number" step="5" min="0" id="max_height" placeholder="400" class="small-text" value="<?php echo esc_attr(self::getOption('max_height')); ?>" <?php echo !$editor_supports ? 'disabled' : '' ?>>
                                                <input type="checkbox" name="exclude_post_types[]" value="<?php echo esc_attr($post_type) ?>" <?php echo is_array($excludePostTypes) && in_array($post_type, $excludePostTypes, true) ? 'checked' : ''; ?>> <?php echo esc_attr($post_type) ?>
                                    <p><textarea name="exclude_urls" rows="10" cols="50" id="exclude_urls" class="large-text code" placeholder="https://irani.im"><?php echo esc_textarea(self::getOption('exclude_urls')); ?></textarea></p>