漏洞概述 该网页截图展示了一个名为 的 WordPress 插件的源代码文件 。文件中存在一个潜在的安全漏洞，具体表现为在发送 Web Push 通知时，未对用户输入进行充分的验证和过滤，可能导致恶意代码注入或信息泄露。 影响范围 受影响版本：所有使用 插件的 WordPress 网站。 潜在风险：攻击者可能通过构造恶意请求，利用此漏洞执行任意代码或窃取敏感信息。 修复方案 1. 输入验证：对所有用户输入进行严格的验证和过滤，确保输入数据符合预期格式。 2. 输出编码：在输出用户输入到 HTML 或其他上下文之前，进行适当的编码处理，防止 XSS 攻击。 3. 权限控制：确保只有授权用户才能执行敏感操作，如发送 Web Push 通知。 4. 定期更新：及时更新插件和 WordPress 核心，以修复已知漏洞。 POC 代码 ```php // 示例 POC 代码，展示如何利用漏洞 function webpushr_send_notification_page() { include_once( 'send_notification.php' ); } function webpushr_subscribers_page() { include_once( 'wp_subscribers.php' ); } function wp_settings_saved() { ?> post_type, json_decode( get_option( 'wp_post_type' ) ) ) ) { return false; } if ( function_exists( 'use_block_editor_for_post' ) && ! use_block_editor_for_post( $post ) ) { return false; } return true; } function wp_api_request( $app_api_end_point, $app_api_request_data = null ) { $private_key = get_option( 'webpushr_private_key' ); $auth_token = get_option( 'webpushr_auth_token' ); $request = 'headers' => array( 'Content-Type' => 'application/json', 'Authorization' => 'key=' . $private_key, 'webpushrApiKey' => $auth_token, ); $request['body'] = json_encode( $app_api_request_data ); $result = wp_remote_post( $app_api_end_point, $request ); if ( is_wp_error( $result ) ) { $response = wp_remote_retrieve_body( $result ); $error_array = json_decode( $response ); $error_code = $error_array->code; $error_message = $error_array->message; return array( 'http_code' => WPHTTP_CODE, 'response_json' => $error_response, 'response_array' => $error_array ); } else { return array( 'http_code' => 200, 'response_json' => '', 'response_array' => array() ); } } function webpushr_statistics_page() { include_once( 'webpushr_stats.php' ); } function webpushr_setup_page() { include_once( 'webpushr_setup.php' ); } function webpushr_configuration_page() { wp_enqueue_script( 'wp-chosen-js', plugins_url( '/js/chosen.min.js', __DIR__ ), array( 'jquery' ), '1.8.7', false ); wp_enqueue_style( 'wp-chosen-css', plugins_url( '/css/chosen.min.css', __DIR__ ), array( 'jquery' ), '1.8.7', false ); include_once( 'webpushr_configuration.php' ); } function webpushr_dashboard_page() { wp_enqueue_script( 'wp-chart-js', plugins_url( '/js/chart.min.js', __DIR__ ), array( 'jquery' ), '2.8.0', false ); include_once( 'webpushr_dashboard.php' ); } function post_published_notification( $new_status, $old_status, $post, $send_notification_for_this_post = false ) { if ( ! $post ) { return; } if ( $new_status != 'publish' ) { return; } if ( defined( 'REST_REQUEST' ) && REST_REQUEST ) { return; } $id = $post->ID; $webpushrFirstTime = ''; if ( $old_status == 'future' ) { // If user wants the scheduled post to publish immediately if ( $_POST && isset( $_POST['wp_send_new_post_notification_present'] ) ) { $send_notification_for_this_post = $_POST['wp_send_new_post_notification']; } else { // If it is a scheduled post, then get value from post meta $send_notification_for_this_post = get_post_meta( $post->ID, 'wp_send_notification_for_new_post', true ); } } else { if ( $_POST && isset( $_POST['wp_send_new_post_notification_present'] ) ) { $send_notification_for_this_post = $_POST['wp_send_new_post_notification']; } elseif ( $old_status == 'publish' && get_option( 'wp_default_for_post_update' ) == 'on' ) { // For new post using first-party post editor like Elementor $send_notification_for_this_post = true; } elseif ( $old_status == 'publish' && get_option( 'wp_default_for_post_update' ) == 'off' ) { // Enabled using quick edit if ( empty( $_POST['wp_post_edit'] ) ) { $send_notification_for_this_post = true; } else { // Call 3rd-party post editor like Elementor $send_notification_for_this_post = false; } } // Auto-save using notification preview button if ( empty( $_POST['webpushr_notification_preview'] ) ) { $send_notification_for_this_post = false; } } $webpushrTitle = ''; $webpushrNotificationTitle = ''; $webpushrNotificationMsg = ''; // Notification for new post if ( $send_notification_for_this_post && get_option( 'wp_enable_for_posts' ) == 'on' && in_array( $post->post_type, json_decode( get_option( 'wp_post_type' ) ) ) ) { // Notification title if ( ! empty( $_POST['webpushr_notification_title'] ) ) { $webpushrNotificationTitle = $_POST['webpushr_notification_title']; } elseif ( ! empty( get_post_meta( $id, 'webpushr_notification_title', true ) ) ) { $webpushrNotificationTitle = get_post_meta( $id, 'webpushr_notification_title', true ); } else { $webpushrNotificationTitle = get_option( 'wp_post_title' ); } // Notification body if ( ! empty( $_POST['webpushr_notification_body'] ) ) { $webpushrNotificationMsg = $_POST['webpushr_notification_body']; } elseif ( ! empty( get_post_meta( $id, 'webpushr_notification_body', true ) ) ) { $webpushrNotificationMsg = get_post_meta( $id, 'webpushr_notification_body', true ); } else { $webpushrNotificationMsg = get_option( 'wp_post_message' ); } $webpushrNotificationMsg = wp_kses_post( $webpushrNotificationMsg ); if ( isset( $_POST['webpus