CVE-2023-36814: zopefoundation's Products.CMFCore vulnerable to unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
Impact The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable.
Patches The code has been fixed in Products.CMFCore version 3.2.
Workarounds Users can make the affected decodeFolderFilter method unreachable by editing the PortalFolder.py module in Products.CMFCore by hand and then restarting Zope. Go to line 233 of PortalFolder.py and remove both the @security.public decorator for decodeFolderFilter as well as the method's entire docstring. This is safe because the method is not actually used by current code.
References - Products.CMFCore security advisory GHSA-4hpj-8rhv-9x87
Credits Thanks go to Nicolas VERDIER from onepoint.
For more information
If you have any questions or comments about this advisory:
- Open an issue in the Products.CMFCore issue tracker - Email us at security@plone.org
Other sources
Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on PortalFolder objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of Products.CMFCore, such as Plone. All deployments are vulnerable. The code has been fixed in Products.CMFCore version 3.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Products.CMFCoreto a version that resolves this vulnerability.Fixed in 3.2 - Upgrade
Upgrade
pip/Products.CMFCoreto a version that resolves this vulnerability.Fixed in 2.7.1 - Upgrade
Upgrade
Products.CMFCoreto a version that resolves this vulnerability.Fixed in 3.2 - Configuration
Go to line 233 of `PortalFolder.py` and remove both the `@security.public` decorator for `decodeFolderFilter` as well as the method's entire docstring.
Products.CMFCore PortalFolder.py (method decodeFolderFilter) Remove @security.public decorator and delete entire method docstring = @security.public decorator removed; docstring removed - Operational
If you applied the manual edit to `PortalFolder.py` to make `decodeFolderFilter` unreachable, restart Zope so the change takes effect.
Event History
Frequently Asked Questions
What is the impact of CVE-2023-36814?
The vulnerability can lead to an unauthenticated denial of service and crash situation.
Which software is affected by CVE-2023-36814?
Products.CMFCore and all portal software built on top of it, such as Plone.
How can the vulnerability be exploited?
By using Python's marshal module to handle unchecked input in a public method on PortalFolder objects.
What is the severity of CVE-2023-36814?
The severity of the vulnerability is high with a severity value of 7.
Where can I find more information about CVE-2023-36814?
You can find more information about CVE-2023-36814 on the following references: [GitHub Commit](https://github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5), [GitHub Security Advisories](https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87), [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2023-36814).