hhdev-mwpcpv.php

<?php
/**
 * Plugin Name: MainWP Check Plugins Vulnerability Extension
 * Plugin URI: https://haha.nl
 * Description: MainWP Extension: Use this extension to check the installed child site plugins for vulnerabilities using data from the wordfence vulnerability data feed api.
 * Version: 1.4.5
 * Author: herbert hoekstra - haha!
 * Author URI: https://haha.nl
 * Documentation URI: https://haha.nl/voorbeelden/mainwp-check-plugins-vulnerability-extension/
 * MainWP Extension: true
 * Text Domain: hhdev-mwpcpv
 * Domain Path: /languages
 * Tags: mainwp, extension, security, vulnerability
 * Requires at least: 6.0
 * Requires PHP: 8.0
 * Required WP: 6.0
 * Tested up to: 6.6.2
 * Requires at least: 6.0
 * License: GPLv2 or later
 * License URI: https://www.gnu.org/licenses/gpl-2.0.html
 */

// information
// for parsing and searching the large json data file this plugin uses:
// https://github.com/halaxa/json-machine/tree/master

if ( ! defined( 'MWPCPV_PLUGIN_DIR_PATH' ) ) {
  define( 'MWPCPV_PLUGIN_DIR_PATH', __DIR__ );
}

 /*
 * Activator Class is used for extension activation and deactivation
 */

 class MainWPCheckPluginVulnerabilityActivator
 {
   // set mainwp vars
   // ------------------
    protected $mainwpMainActivated = false;
    protected $childEnabled = false;
    protected $childKey = false;
    protected $childFile;
   	protected $plugin_handle = 'mainwp-check-plugins-vulnerability';
    protected $product_id = 'MainWP Check Plugins Vulnerability Extension';
  	protected $software_version = '1.4.5';  // used for mwp update notice

    // set custom plugin vars
    // -------------------
    protected $api_url = 'https://wordfence.com/api/intelligence/v2/vulnerabilities/production';
    // base file whole vuln database
    protected $file_name = 'vulnerabilities.production.json';
    protected $dir_path = WP_CONTENT_DIR . '/hhdev-mwpcpv-data';
    protected $dir_path_file = WP_CONTENT_DIR . '/hhdev-mwpcpv-data/vulnerabilities.production.json';
    // file after extraction, 2 years days updated
    protected $file_name_vuln = 'vuln-data.json';
    protected $dir_path_file_vuln = WP_CONTENT_DIR . '/hhdev-mwpcpv-data/vuln-data.json';

    protected $text_domain = 'hhdev-mwpcpv';


    // the plugin set up
    // --------------------
    public function __construct() {

      require_once MWPCPV_PLUGIN_DIR_PATH . '/vendor/autoload.php';

      $this->childFile = __FILE__;

      add_filter('mainwp_getextensions', array(&$this, 'get_this_extension'));

      // This filter will return true if the main plugin is activated
      $this->mainwpMainActivated = apply_filters('mainwp_activated_check', false);

      if ($this->mainwpMainActivated !== false) {

         $this->activate_this_plugin();

      } else {

         //Because sometimes our main plugin is activated after the extension plugin is activated we also have a second step,
         //listening to the 'mainwp_activated' action. This action is triggered by MainWP after initialisation.
         add_action('mainwp_activated', array(&$this, 'activate_this_plugin'));
      }

      add_action('admin_notices', array(&$this, 'mainwp_error_notice'));

      // add updater
      // ---------------
      $myUpdateChecker = YahnisElsts\PluginUpdateChecker\v5\PucFactory::buildUpdateChecker(
      'https://github.com/herbie4/mainwp-check-plugins-vulnerability-extension/',
      __FILE__,
      'hhdev-mwpcpv.php'
    );
      //Set the branch that contains the stable release.
      $myUpdateChecker->setBranch('master');

     }

     // used for loading the dashboard page
     // 'api' => $this->plugin_handle, 'mainwp' => false, ???
     // --------------------------
     function get_this_extension($pArray) {
         $pArray[] = array(
           'plugin' => __FILE__,
           'callback' => array(&$this, 'settings'),
           'on_load_callback' => false,
           'mainwp' => true,
           'api' => false,
           'apiManager' => false,
           'name' => 'Check Plugins Vulnerability',
           'icon' => plugin_dir_url(__FILE__) .'assets/images/check-vuln-icon.png'
         );
         return $pArray;
     }

     // load the dashboard page
     // ----------------------
     function settings() {
         //The "mainwp-pageheader-extensions" action is used to render the tabs on the Extensions screen.
         //It's used together with mainwp-pagefooter-extensions and mainwp-getextensions
         do_action('mainwp_pageheader_extensions', __FILE__);

         if ($this->childEnabled)
         {
             MainWPCheckPluginVulnerability::hhdev_mwpcpv_render_page();
         }
         else
         {
             ?><div class="mainwp_info-box-yellow"><?php _e("The Extension has to be enabled to change the settings."); ?></div><?php
         }

         do_action('mainwp_pagefooter_extensions', __FILE__);
     }

     //The function "activate_this_plugin" is called when the main is initialized.
     // ------------------------
     function activate_this_plugin() {

       //Checking if the MainWP plugin is enabled. This filter will return true if the main plugin is activated.
       $this->mainwpMainActivated = apply_filters('mainwp_activated_check', $this->mainwpMainActivated);

       // The 'mainwp_extension_enabled_check' hook. If the plugin is not enabled this will return false,
       // if the plugin is enabled, an array will be returned containing a key.
       // This key is used for some data requests to our main
       $this->childEnabled = apply_filters('mainwp_extension_enabled_check', __FILE__);

       $this->childKey = $this->childEnabled['key'];

 		   new MainWPCheckPluginVulnerability();
     }
     // if not loaded MainWP error notice
     // -------------------------
     function mainwp_error_notice()
     {
         global $current_screen;
         if ($current_screen->parent_base == 'plugins' && $this->mainwpMainActivated == false)
         {
             echo '<div class="error"><p>MainWP Check Plugins Vulnerability Extension ' . __('requires '). '<a href="http://mainwp.com/" target="_blank">MainWP</a>'. __(' Plugin to be activated in order to work. Please install and activate') . '<a href="http://mainwp.com/" target="_blank">MainWP</a> '.__('first.') . '</p></div>';
         }
     }

     public function getChildKey()
     {
         return $this->childKey;
     }

     public function getChildFile()
     {
         return $this->childFile;
     }

     // plugin functions
     // -----------------------

     // get a groups dropdown menu
     // posts: 'show_all' or group ID
     // group id as selected
     // ------------------------
     public function hhdev_get_groups_dropdown($selected_option) {

       // get groups (tags)
       $groups = \MainWP\Dashboard\MainWP_DB_Common::instance()->get_groups_and_count();
       $selected = ''; // selected default

       $dropmenu = '<select class="ui selection dropdown" name="mwpcpv-groups" id="groups">';
       $dropmenu .= '<option value="show_all" '.$selected.'>'.__('Show all','hhdev-mwpcpv').'</option>';
       foreach ( $groups as $group ) {
         if($selected_option == $group->id) $selected = 'selected';
          $dropmenu .= '<option value="'.$group->id.'"'.$selected.'>'.$group->name.'</option>';
          $selected = ''; // reset selected
       }
       $dropmenu .= '</select>';

       return $dropmenu;

     }

     // save api data file to directory
     // fires on scan start
     // -----------------------------
     public function hhdev_save_api_data_file(){

       if (!is_dir($this->dir_path)) { mkdir($this->dir_path, 0777, true); }
       $data = file_get_contents($this->api_url);
       $store = file_put_contents($this->dir_path_file, $data);

       return $store; // false or true
     }

     // check if data file exists
     // ---------------------------
     public function hhdev_data_file_exists() {

       $file = file_exists($this->dir_path_file);

       return $file;
     }

     // get the current data file date
     // ------------------------------
     public function hhdev_get_file_date(){

       clearstatcache(true, $this->dir_path_file); // filemtime is cached so clear it before!

       date_default_timezone_set(get_option( 'timezone_string' ) ); // set timezone to wp timezone option
       $date_format = get_option( 'date_format'); // use wp date format
       $date = date($date_format . ' H:i:s', filemtime($this->dir_path_file));

       return $date;
     }

     // check if version number is correct syntax
     // also no RC or beta versions allowed
     // ---------------------------
     public function hhdev_check_version_syntax($version) {
       // only numbers and dots allowed
       if (!preg_match('/^[0-9]+(\\.[0-9]+)?$/', $version)){
         // clean up the version number
         $version_array = explode(' ', $version);
         $result = \Jelix\Version\Parser::parse($version_array[0]);
         return $result->tostring();
       }
       return $version;
     }

     // check version compare
     // if A < B -> -1
     // if A == B -> 0
     // if A > B -> 1
     // ----------------------
     public function hhdev_plugin_needs_update($plugin_version, $data_version, $compare){

       $plugin_version = $this->hhdev_check_version_syntax($plugin_version);

       $result = \Jelix\Version\VersionComparator::compareVersion($plugin_version, $data_version);

       if($compare == '<' && $result == -1) return true;
       if($compare == '<=' && $result == 0) return true;

       return false;
     }

    // load adapted vulnerability file
    // ---------------------------
    public function hhdev_load_file(){

      $result = file_get_contents($this->dir_path_file_vuln);

      return $result;
    }

    // get version from nested array in data file
    // -----------------------------
    public function hhdev_get_version_from_array($array) {

      foreach($array as $key => $version) {
        $result = $version;
      }
      return $result;
    }

    // change the data file structure and make it smaller
    // uses halaxa/json-machine
    // -----------------------------
    public function hhdev_make_adapted_file() {

      // get the current date
      date_default_timezone_set(get_option( 'timezone_string' ));
      $cur_date = date('Y-m-d');

      // set 3 month ago
      $date = date('Y-m-d', strtotime( $cur_date .'-24 month'));

      // read the json file
      // --------------------
      $fileSize = filesize($this->dir_path_file);
      $data = \JsonMachine\Items::fromFile($this->dir_path_file);

      // set file array
      $file = array();

      foreach($data as $plugin) {

      //  print_r($plugin->software[0]->slug);

        if($plugin->updated > $date) {
          // write to new array
          // check if type is plugin
          if($plugin->software[0]->type === 'plugin') $file[] = array(
            'slug' => $plugin->software[0]->slug,
            'title' => $plugin->title,
            'name' => $plugin->software[0]->name,
            'affected_versions' => json_decode(json_encode($plugin->software[0]->affected_versions),true),
            'patched' => $plugin->software[0]->patched,
            'references' => $plugin->references,
            'updated' => $plugin->updated,
          );
          //echo '<p>Progress: ' . intval($data->getPosition() / $fileSize * 100) . ' %</p>';
        }

      }

    //  print_r($file);

      //echo wp_sprintf( '<p>', __('Records saved: %s','hhdev-mwpcpv'), count($file),'</p>');

      $result = file_put_contents($this->dir_path_file_vuln, json_encode($file,JSON_UNESCAPED_UNICODE));

      //if ($result) echo '<p>File created!</p>';
      return $result; // true or false

    }

 }

 // load the plugin dashboard
 // --------------------------
 require_once( MWPCPV_PLUGIN_DIR_PATH . '/class/class-dashboard.php');

 global $MainWPCheckPluginVulnerabilityActivator;
 $MainWPCheckPluginVulnerabilityActivator = new MainWPCheckPluginVulnerabilityActivator();



 /*
data example of api data from file as array()
data select based on: array(...
1 [title]
2. [software][0][type] => plugin
3. [software][0][slug] => text
3. [software][0][affected_versions][some key][to_version] => string
4. [software][0][affected_versions][remediation] => text
5. [description]=> text
6. [references]=> text
7. [updated] => date

[61c39f5f-3b17-4e4d-824e-241159a73400] => Array
       (
           [id] => 61c39f5f-3b17-4e4d-824e-241159a73400
           [title] => Contact Form Builder by vcita <= 4.9.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
           [software] => Array
               (
                   [0] => Array
                       (
                           [type] => plugin
                           [name] => Contact Form Builder by vcita
                           [slug] => contact-form-with-a-meeting-scheduler-by-vcita
                           [affected_versions] => Array
                               (
                                   [* - 4.9.1] => Array
                                       (
                                           [from_version] => *
                                           [from_inclusive] => 1
                                           [to_version] => 4.9.1
                                           [to_inclusive] => 1
                                       )

                               )

                           [patched] =>
                           [patched_versions] => Array
                               (
                               )

                           [remediation] => No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
                       )

               )

           [description] => The Contact Form Builder by vcita plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.9.1. This is due to missing nonce validation on the ls_parse_vcita_callback function. This makes it possible for unauthenticated attackers to modify the plugin's settings and inject malicious JavaScript via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. While the Cross-Site Scripting issue was patched in version 4.10.1, the plugin is still technically vulnerable to Cross-Site Request Forgery since a capability check but no nonce check was added in 4.10.2.
           [references] => Array
               (
                   [0] => https://www.wordfence.com/threat-intel/vulnerabilities/id/61c39f5f-3b17-4e4d-824e-241159a73400?source=api-prod
               )

           [cwe] => Array
               (
                   [id] => 352
                   [name] => Cross-Site Request Forgery (CSRF)
                   [description] => The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
               )

           [cvss] => Array
               (
                   [vector] => CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
                   [score] => 6.1
                   [rating] => Medium
               )

           [cve] => CVE-2023-2301
           [cve_link] => https://www.cve.org/CVERecord?id=CVE-2023-2301
           [researchers] => Array
               (
                   [0] => Jonas Höbenreich
               )

           [published] => 2023-06-02 00:00:00
           [updated] => 2023-07-05 17:46:13
           [copyrights] => Array
               (
                   [message] => This record contains material that is subject to copyright
                   [defiant] => Array
                       (
                           [notice] => Copyright 2012-2023 Defiant Inc.
                           [license] => Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy.
                           [license_url] => https://www.wordfence.com/wordfence-intelligence-terms-and-conditions/
                       )

                   [mitre] => Array
                       (
                           [notice] => Copyright 1999-2023 The MITRE Corporation
                           [license] => CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy.
                           [license_url] => https://www.cve.org/Legal/TermsOfUse
                       )

               )

       )
 */