CVE-2015-10116 (published 2023-06-06T01:15Z)

A vulnerability classified as problematic has been found in RealFaviconGenerator Favicon Plugin up to 1.2.12 on WordPress. This affects the function install_new_favicon of the file admin/class-favicon-by-realfavicongenerator-admin.php. The manipulation leads to cross-site request forgery. It is possible to initiate the attack remotely. Upgrading to version 1.2.13 is able to address this issue. The identifier of the patch is 949a1ae7216216350458844f50a72f100b56d4e7. It is recommended to upgrade the affected component. The identifier VDB-230661 was assigned to this vulnerability.

CVSS v3 base score: 8.8, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-352
cwe_name: Cross-Site Request Forgery (CSRF)
description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
extended_description: When a web server is designed to receive a request from a client without any mechanism for verifying that it was intentionally sent, then it might be possible for an attacker to trick a client into making an unintentional request to the web server which will be treated as an authentic request. This can be done via a URL, image load, XMLHttpRequest, etc. and can result in exposure of data or unintended code execution.
         

Fix information:
repo_url: https://github.com/wp-plugins/favicon-by-realfavicongenerator
commit_details: repo_url: https://github.com/wp-plugins/favicon-by-realfavicongenerator
author: phbernard
author_date: 2015-04-01 11:55:13+00:00
msg: XSS vulnerability fixed, reported by Kacper Szurek

git-svn-id: https://plugins.svn.wordpress.org/favicon-by-realfavicongenerator/trunk@1125286 b8457f37-d9ea-0310-8a92-e5e31aec5664
repository: repo_url: https://github.com/wp-plugins/favicon-by-realfavicongenerator
repo_name: wp-plugins/favicon-by-realfavicongenerator
description: WordPress.org Plugin Mirror
repo_language: PHP
owner: wp-plugins
file_changes: filename: README.txt
change_type: ModificationType.MODIFY
diff: @@ -3,11 +3,11 @@ Contributors: phbernard
 Tags: favicon, apple-touch-icon, realfavicongenerator
 Requires at least: 3.5
 Tested up to: 4.1.1
-Stable tag: 1.2.12
+Stable tag: 1.2.13
 License: GPLv2
 License URI: http://www.gnu.org/licenses/gpl-2.0.html
 
-Create and install your favicon for all platforms: PC/Mac of course, but also iPhone/iPad, Android devices, Windows 8 tablets...
+Create and install your favicon for all platforms: PC/Mac, iPhone/iPad, Android devices, Windows 8 tablets...
 
 == Description ==
 
@@ -72,6 +72,10 @@ This screen presents you a preview of the favicon you various platforms, so you
 
 == Changelog ==
 
+= 1.2.13 =
+
+- XSS vulnerability fixed, reported by [Kacper Szurek](http://security.szurek.pl/)
+
 = 1.2.12 =
 
 - Performance improvements: favicon update checking is now done in the Admin section (not the Public section), locales are not loaded in the Public section anymore.

programming_language: Markdown
filename: class-favicon-by-realfavicongenerator-admin.php
change_type: ModificationType.MODIFY
diff: @@ -9,6 +9,7 @@ class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenera
 	const DISMISS_UPDATE_NOTIICATION = 'fbrfg_dismiss_update_notification';
 	const DISMISS_UPDATE_ALL_UPDATE_NOTIICATIONS = 'fbrfg_dismiss_all_update_notifications';
 	const SETTINGS_FORM = 'fbrfg_settings_form';
+	const NONCE_ACTION_NAME = 'favicon_generation';
 
 	protected static $instance = null;
 
@@ -125,6 +126,9 @@ class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenera
 			$new_favicon_params_url = NULL;
 		}
 
+		// Nonce
+		$nonce = wp_create_nonce( NONCE_ACTION_NAME );
+
 		// External files
 		wp_enqueue_script( 'jquery' );
 		wp_enqueue_script( 'jquery-ui' );
@@ -161,21 +165,31 @@ class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenera
 
 			$response = new Favicon_By_RealFaviconGenerator_Api_Response( $result );
 
-			$zip_path = Favicon_By_RealFaviconGenerator_Common::get_tmp_dir();
-			if ( ! file_exists( $zip_path ) ) {
-				mkdir( $zip_path, 0755, true );
+			if ( ! wp_verify_nonce( $response->getCustomParameter(), NONCE_ACTION_NAME ) ) {
+				// Attack in progress?
+?>
+{
+	"status": "error",
+	"message": "<?php _e( 'Nonce was not recognized. This case is supposed to happen only in case of XSS attack. If you feel like something is wrong, please <a href=\"mailto:contact@realfavicongenerator.net\">contact us</a>.', FBRFG_PLUGIN_SLUG ) ?>"
+}
+<?php
 			}
-			$response->downloadAndUnpack( $zip_path );
+			else {
+				$zip_path = Favicon_By_RealFaviconGenerator_Common::get_tmp_dir();
+				if ( ! file_exists( $zip_path ) ) {
+					mkdir( $zip_path, 0755, true );
+				}
+				$response->downloadAndUnpack( $zip_path );
 
-			$this->store_pictures( $response );
+				$this->store_pictures( $response );
 
-			$this->store_preview( $response->getPreviewPath() );
+				$this->store_preview( $response->getPreviewPath() );
 
-			Favicon_By_RealFaviconGenerator_Common::remove_directory( $zip_path );
+				Favicon_By_RealFaviconGenerator_Common::remove_directory( $zip_path );
 
-			update_option( Favicon_By_RealFaviconGenerator_Common::OPTION_HTML_CODE, $response->getHtmlCode() );
-			
-			$this->set_favicon_configured( true, $response->isFilesInRoot(), $response->getVersion() );
+				update_option( Favicon_By_RealFaviconGenerator_Common::OPTION_HTML_CODE, $response->getHtmlCode() );
+				
+				$this->set_favicon_configured( true, $response->isFilesInRoot(), $response->getVersion() );
 ?>
 {
 	"status": "success",
@@ -183,6 +197,7 @@ class Favicon_By_RealFaviconGenerator_Admin extends Favicon_By_RealFaviconGenera
 	"favicon_in_root": <?php echo json_encode( $this->is_favicon_in_root() ) ?>
 }
 <?php
+			}
 		}
 		catch(Exception $e) {
 ?>

programming_language: PHP
filename: appearance.php
change_type: ModificationType.MODIFY
diff: @@ -184,6 +184,7 @@
 			: 'favicon-by-realfavicongenerator/admin/class-favicon-by-realfavicongenerator-admin.phpfavicon_appearance_menu' ) ) ?>";
 		params.favicon_generation.callback.short_url = 'true';
 		params.favicon_generation.callback.path_only = 'true';
+		params.favicon_generation.callback.custom_parameter = "<?php echo $nonce ?>";
 
 		return params;
 	}

programming_language: PHP
filename: favicon-by-realfavicongenerator.php
change_type: ModificationType.MODIFY
diff: @@ -12,7 +12,7 @@
  * Plugin Name:       Favicon by RealFaviconGenerator
  * Plugin URI:        http://realfavicongenerator.net/extensions/wordpress
  * Description:       Create and install your favicon for all platforms: PC/Mac of course, but also iPhone/iPad, Android devices, Windows 8 tablets, etc. 
- * Version:           1.2.12
+ * Version:           1.2.13
  * Author:            Philippe Bernard
  * Author URI:        http://realfavicongenerator.net/
  * License:           GPLv2

programming_language: PHP