GHSA-4xfr-4p46-gc6p: Medium severity pip/django-cms vulnerability
Summary The clipboard copy paths of the copyplugins admin endpoint validate only the target (the user's own clipboard) and skip source-side authorization. A staff user can copy plugins out of a placeholder they have no permission on into their clipboard, then read the (secret) content.
### Details In cms/admin/placeholderadmin.py, copyplugintoclipboard and copyplaceholdertoclipboard check hascopypluginspermission, which only evaluates request.toolbar.clipboard.hasaddpluginspermission(...) — the clipboard belongs to the requesting user, and checksource is likewise applied only to the clipboard. The source placeholder identified by the attacker-supplied sourceplaceholderid / sourcepluginid is never authorization-checked. (The placeholder-to-placeholder copy path, hascopyfromplaceholderpermission, correctly checks both sides.)
### Impact A staff user holding the global add permission for a plugin type, but with no access to a given placeholder/page, can copy that placeholder's plugins into their own clipboard and read content (e.g. link names/URLs, text) they cannot reach through the normal edit endpoints.
Requires CMSPERMISSION=True with per-placeholder/page restrictions.
### Patches Fixed in 5.0.8: the clipboard copy paths now also verify source-side permission (hasaddpluginspermission + checksource on the source placeholder), matching placeholder-to-placeholder copy.
### Workarounds None. Upgrade is recommended.
### Credits Reported by the security team at the University of Sydney ([@reporter]).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/django-cmsto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
Django CMS (clipboard copy permission checks in cms/admin/placeholderadmin.py)to a version that resolves this vulnerability.Fixed in 5.0.8 - Configuration
Ensure CMS_PERMISSION=True so per-placeholder/page restrictions are enforced for staff users with clipboard copy access.
Django CMS admin clipboard copy endpoint (copy_plugins) CMS_PERMISSION = True - Compensating control
Enforce/verify per-placeholder/page restrictions so staff users without source-placeholder access cannot use the copy_plugins admin endpoint to copy plugins from a source placeholder they cannot access.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using django-cms with CMS_PERMISSION=True are affected when a staff user has the global add permission for a plugin type. That user may lack access to the target placeholder or page and still copy its plugins into their own clipboard.
What does an attacker need to exploit it?
An attacker needs staff access and the global add permission for the relevant plugin type. They can supply a source placeholder or plugin identifier to the clipboard copy path; no user interaction is required.
What information can be disclosed?
The issue can expose secret content stored in plugins that the staff user cannot normally access through edit endpoints, including link names, URLs, and text.
Is the normal placeholder-to-placeholder copy operation affected?
No. The placeholder-to-placeholder copy path checks permissions on both the source and destination; the affected paths are copying a plugin or placeholder to the user's clipboard.