CVE-2024-1110 (published 2024-02-07T11:15Z)

The Podlove Podcast Publisher plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the init() function in all versions up to, and including, 4.0.11. This makes it possible for unauthenticated attackers to import the plugin's settings.

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Weakness information:
cwe_id: CWE-862
cwe_name: Missing Authorization
description: The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
extended_description: 
            Assuming a user with a given identity, authorization is the process of determining whether that user can access a given resource, based on the user's privileges and any permissions or other access-control specifications that apply to the resource.
            When access control checks are not applied, users are able to access data or perform actions that they should not be allowed to perform. This can lead to a wide range of problems, including information exposures, denial of service, and arbitrary code execution.
         
         

Fix information:
repo_url: https://github.com/podlove/podlove-publisher
commit_details: repo_url: https://github.com/podlove/podlove-publisher
author: Eric Teubert
author_date: 2024-02-04 21:11:18+01:00
msg: fix: add missing capability check and nonce validation to importer functions
repository: repo_url: https://github.com/podlove/podlove-publisher
repo_name: podlove/podlove-publisher
description: Podlove Podcast Publisher for WordPress
repo_language: PHP
owner: podlove
file_changes: filename: podcast_importer.php
change_type: ModificationType.MODIFY
diff: @@ -30,6 +30,14 @@ class PodcastImporter
             return;
         }
 
+        if (!current_user_can('administrator')) {
+            return;
+        }
+
+        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import')) {
+            return;
+        }
+
         // allow xml+gz uploads
         add_filter('mime_types', function ($mimes) {
             $mimes['xml'] = 'application/xml';

programming_language: PHP
filename: tracking_importer.php
change_type: ModificationType.MODIFY
diff: @@ -24,6 +24,14 @@ class TrackingImporter
             return;
         }
 
+        if (!current_user_can('administrator')) {
+            return;
+        }
+
+        if (!wp_verify_nonce($_REQUEST['_podlove_nonce'], 'podlove_import_tracking')) {
+            return;
+        }
+
         set_time_limit(10 * MINUTE_IN_SECONDS);
 
         add_filter('upload_mimes', function ($mimes_types) {

programming_language: PHP
filename: import_export.php
change_type: ModificationType.MODIFY
diff: @@ -215,6 +215,7 @@ class Import_Export extends \Podlove\Modules\Base
 			(<span><?php echo self::get_maximum_upload_size_text(); ?></span>)
 			<input type="file" name="podlove_import"/> 
 			<input type="submit" value="<?php echo __('Import Podcast Data', 'podlove-podcasting-plugin-for-wordpress'); ?>" class="button" />
+			<?php wp_nonce_field('podlove_import', '_podlove_nonce'); ?>
 		</form>		
 		<?php
     }
@@ -226,6 +227,7 @@ class Import_Export extends \Podlove\Modules\Base
 			(<span><?php echo self::get_maximum_upload_size_text(); ?></span>)
 			<input type="file" name="podlove_import_tracking"/>
 			<input type="submit" value="<?php echo __('Import Tracking Data', 'podlove-podcasting-plugin-for-wordpress'); ?>" class="button" />
+			<?php wp_nonce_field('podlove_import_tracking', '_podlove_nonce'); ?>
 		</form>		
 		<?php
     }

programming_language: PHP
filename: readme.txt
change_type: ModificationType.MODIFY
diff: @@ -108,7 +108,10 @@ This product includes GeoLite2 data created by MaxMind, available from http://ww
 
 = 4.0.12 =
 
+**Security**
+
 - fix SSRF vulnerability in Slacknotes module
+- add missing capability check and nonce validation to importer functions
 
 = 4.0.11 =
 

programming_language: Markdown