search

Weather-Station-Software / live-weather-station

Display on your WordPress site, in many elegant ways, the meteorological data collected by public or personal weather stations.
https://weather.station.software/
GNU General Public License v2.0
7 stars 2 forks source link

Reported vulnerability by WPScan #23

Closed jkclose closed 1 year ago

jkclose commented 1 year ago

Is this a known issue? I haven't seen any discussion about it on any of the support sites.

https://wpscan.com/vulnerability/821a350d-04c7-406a-9c6f-31659584699c

jaz-on commented 1 year ago

Hello @jkclose thanks for sharing this here with me. This has been reported to me already via this patchstack page.

As the plugin has only been transferred to me in full a few weeks ago, I haven't had time yet to investigate it properly.

So far, no one has reported that any sites have been hacked through the potential vulnerability reported in the Weather Station plugin. I'll take some time to investigate it further and it will eventually be fixed in the future.

If you have any suggestions regarding this issue, I'd like to hear from you.

jkclose commented 1 year ago

Awesome. Glad to hear it is already a known issue. We hadn't opted to disable the plugin as it seemed secure so far, so I'll just keep an eye out for updates.

Thanks for adopting the plugin!

jaz-on commented 1 year ago

Quick follow-up, the WordPress.org plugin team temporarily suspended the plugin from being downloaded from the public repository. I'm in touch with them and Patchstack to resolve the situation. It seems that they have slightly overestimated the report on Patchstack.

The only effect is to be able to force an admin to change the display mode of Weather Station settings.

Patch is in the way.

jaz-on commented 1 year ago

I'm working on a PR to solve this problem. In short, nonces are needed for some parameters located settingsGeneral.php and SystemPluginAdmin.php files. The patch should be made available in the coming days. (FYI I'm currently on holiday, I didn't plan to work on the plugin but will do the max to solve this asap.)

jaz-on commented 1 year ago

I marked this issue as "close" but it's still monitored on my side.

I'll push a new version of the plugin in a few minutes to SVN and email the plugin review team asking for them to review the plugin and relist it publicly on the WordPress.org repository.

jaz-on commented 1 year ago

Hi @jkclose and @Duhlin12 I just received confirmation that the plugin has been reactivated on https://wordpress.org/plugins/live-weather-station/

New version is now available: v3.8.13