GHSA-r82h-mqw3-fc56: XSS
Impact By abusing the iCalendar import functionality, a logged-in editor could take the whole site offline, make the server reach into the internal network and read calendar files off disk (SSRF), and store XSS.
Patches The problem has been patched in plone.app.event.
For Plone 6.2: upgrade to plone.app.event 6.0.1 For Plone 6.1: upgrade to plone.app.event 5.2.4 For Plone 6.0: upgrade to plone.app.event 5.2.4
Workarounds In the site root, go to the Security tab of the Zope Management Interface (manageaccess), look for the "plone.app.event: Import Ical" permission, and grant this only to the Manager role. Then only users with the Manager role can use the ical import form.
There is no workaround for the stored XSS in the URL field of events.
The vulnerabilities were discovered by Timothy Dudley and responsibly reported to the Plone Security Team. Thank you!
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/plone.app.eventto a version that resolves this vulnerability.Fixed in 6.0.1 - Upgrade
Upgrade
pip/plone.app.eventto a version that resolves this vulnerability.Fixed in 5.2.4 - Upgrade
Upgrade
plone.app.eventto a version that resolves this vulnerability.Fixed in 5.2.4 - Upgrade
Upgrade
plone.app.eventto a version that resolves this vulnerability.Fixed in 6.0.1 - Configuration
In the site root, open the Security tab of the Zope Management Interface (manage_access). Find the permission "plone.app.event: Import Ical" and grant it only to the Manager role.
Zope Management Interface (ZMI) Security tab manage_access permission 'plone.app.event: Import Ical' = Grant only to Manager role
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must be logged in with editor-level access and be able to use the iCalendar import functionality. Restricting the “plone.app.event: Import Ical” permission to the Manager role prevents non-Managers from using that import form.
Which versions should be upgraded?
For Plone 6.2, upgrade plone.app.event to 6.0.1. For Plone 6.1 and 6.0, upgrade to plone.app.event 5.2.4.
What can be done if patching cannot happen immediately?
In the site root's Zope Management Interface Security tab (manage_access), grant the “plone.app.event: Import Ical” permission only to the Manager role. This mitigates the import-related site outage and internal-network/file-read risks, but there is no workaround for the stored XSS in event URL fields.