search

pluck-cms / pluck

Central repo for pluck cms
http://www.pluck-cms.org
54 stars 37 forks source link

Pluck 4.7.15 - Missing SSL Certificate Validation in update_applet.php #101

Closed naiagoesawoo closed 3 years ago

naiagoesawoo commented 3 years ago

Issue Summary Pluck's update system deliberately skips SSL certificate validation.

Detailed Description Within update_applet.php is the following code:

        // Dont check ssl certifical
        curl_setopt($geturl, CURLOPT_SSL_VERIFYPEER, false);

This ensures peer SSL certificates are never valdiated.

Impact In theory, this vulnerability can make the Pluck's update system susceptible to Man-in-the-middle attacks.

BSteelooper commented 3 years ago

Could you perform a retest with the latest dev version?

naiagoesawoo commented 3 years ago

Hello,

I confirm that the reported missing SSL Certificate Validation issue has been fixed. :)

debug601 commented 2 years ago

你好

我确认报告的缺少SSL证书验证问题已修复。:)

Boss, how did you apply for the cve number?