Pluck 4.7.15 - Missing SSL Certificate Validation in update_applet.php

[naiagoesawoo]

Issue Summary
Pluck's update system deliberately skips SSL certificate validation.

Detailed Description
Within update_applet.php is the following code:

		// Dont check ssl certifical
		curl_setopt($geturl, CURLOPT_SSL_VERIFYPEER, false);

This ensures peer SSL certificates are never valdiated.

Impact
In theory, this vulnerability can make the Pluck's update system susceptible to Man-in-the-middle attacks.

[BSteelooper]

Could you perform a retest with the latest dev version?

[naiagoesawoo]

Hello,

I confirm that the reported missing SSL Certificate Validation issue has been fixed. :)

[k0xx11]

你好

我确认报告的缺少SSL证书验证问题已修复。:)

Boss, how did you apply for the cve number?