GHSA-x5g3-w747-2h8q: XSS
Impact By adding an RSS portlet, and giving this a link to a very large file, a member can cause a denial of service attack, because Plone will use lots of memory. The member could also use different urls to try to get information about the internal network and open port numbers (SSRF). A malicious RSS feed could cause stored XSS, when the url of a feed item is a javascript url.
Patches The problem has been patched in plone.app.portlets.
For Plone 6.2: upgrade to plone.app.portlets 7.0.2 For Plone 6.1: upgrade to plone.app.portlets 6.0.4 For Plone 6.0: upgrade to plone.app.portlets 5.0.8
Workarounds If upgrading is not immediately possible:
- Restrict who can manage portlets: remove the plone.app.portlets.ManageOwnPortlets permission from untrusted roles, and limit Manage portlets to trusted administrators (usually this is already restricted to the Manager and Site Administrator roles). - Where the RSS portlet is not needed, unregister it so it cannot be added. This would need to be done by editing a portlets.xml in your own code, so it is not a quick fix.
References
This is similar to this plone.app.event vulnerability. It was discovered by the Plone Security Team by thinking of similar cases to the plone.app.event problem.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/plone.app.portletsto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
pip/plone.app.portletsto a version that resolves this vulnerability.Fixed in 6.0.4 - Upgrade
Upgrade
pip/plone.app.portletsto a version that resolves this vulnerability.Fixed in 7.0.2 - Upgrade
Upgrade
plone.app.portletsto a version that resolves this vulnerability.Fixed in 5.0.8 - Upgrade
Upgrade
plone.app.portletsto a version that resolves this vulnerability.Fixed in 6.0.4 - Upgrade
Upgrade
plone.app.portletsto a version that resolves this vulnerability.Fixed in 7.0.2 - Configuration
Restrict who can manage portlets by removing the plone.app.portlets.ManageOwnPortlets permission from untrusted roles and limiting Manage portlets to trusted administrators.
Plone portlets (plone.app.portlets) Manage portlets permissions (plone.app.portlets.ManageOwnPortlets) = Remove plone.app.portlets.ManageOwnPortlets from untrusted roles; limit Manage portlets to trusted administrators (Manager/Site Administrator). - Configuration
If the RSS portlet is not needed, unregister it so it cannot be added.
Plone RSS portlet RSS portlet registration (unregister if not needed) = Unregister
Event History
Frequently Asked Questions
Who can exploit this issue?
A member who can add an RSS portlet can exploit the issue. Risk is reduced when portlet-management permissions are limited to trusted administrators.
What can an attacker do with RSS portlet access?
They can point a portlet at a very large file to consume substantial memory and cause denial of service, use different URLs to probe internal network information and open ports, or supply a malicious feed containing a javascript URL that results in stored XSS.
Which versions contain a fix?
For Plone 6.2, upgrade plone.app.portlets to 7.0.2. For Plone 6.1, upgrade to 6.0.4; for Plone 6.0, upgrade to 5.0.8.
What can be done if an upgrade cannot happen immediately?
Remove the plone.app.portlets.ManageOwnPortlets permission from untrusted roles and restrict portlet management to trusted administrators. If RSS portlets are not needed, unregister the RSS portlet through a portlets.xml change in your own code.