Impact A url /login?camefrom=////evil.example may redirect to an external website after login.

Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.

Patches The problem has been patched in Products.isurlinportal.

Plone 6.2: upgrade to Products.isurlinportal 4.0.0. Plone 6.1: upgrade to Products.isurlinportal 3.1.0. Plone 6.0: upgrade to Products.isurlinportal 2.1.0. Older Plone versions don't have security support anymore.

Workarounds There are no known workarounds.

Background When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.

This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.

The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.

This was discovered during a penetration test by the CERT-EU Team.

Impact Patches Volto 16: 16.34.0 Volto 17: 17.22.1 Volto 18: 18.24.0 Workarounds Report Github Advisory Maurits van Rees Plone/Zope Security Team

Due to incorrect access control in Plone version v6.0.9, remote attackers can view and list all files hosted on the website via sending a crafted request.

The HTTP PUT and DELETE methods are enabled in the Plone official Docker version 5.2.13 (5221), allowing unauthenticated attackers to execute dangerous actions such as uploading files to the server or deleting them.

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software that could allow for remote code execution due to a package listed in ++plone++static/components not existing in the public package index (npm).

An issue in Plone Docker Official Image 5.2.13 (5221) open-source software allows for remote code execution via improper validation of input by the HOST headers.

A Cross-Frame Scripting vulnerability has been found on Plone CMS affecting version below 6.0.5. An attacker could store a malicious URL to be opened by an administrator and execute a malicios iframe element.

The information can be found here: https://community.plone.org/t/plone-security-advisory-2023-09-21/17941 https://plone.org/security/hotfix/20230921

The text is included below.

Denial of service

Stored XSS

Fixes are needed in three packages. We link to the security advisories: Information disclosure and sandbox escape Fixed Plone versions Package versions Fixes are available in these versions:

AccessControl = 4.4, 5.8, 6.2 RestrictedPython = 5.4, 6.2 plone.namedfile = 5.6.1, 6.0.3, 6.1.3, 6.2.1 plone.rest = 2.0.1, 3.0.1 plone.restapi = 8.43.4 Zope = 4.8.10, 5.8.5

So which versions of these packages should you use on which Plone version? Plone 5.2

AccessControl = 4.4 plone.namedfile = 5.6.1 RestrictedPython = 5.4 Zope = 4.8.10 plone.restapi = 8.43.4

Plone 6.0.0/6.0.1

AccessControl = 5.8 plone.namedfile = 6.0.3 plone.rest = 2.0.1 plone.restapi = 8.43.4 RestrictedPython = 6.2 Zope = 5.8.5

Plone 6.0.2

AccessControl = 5.8 plone.namedfile = 6.0.3 plone.rest = 3.0.1 plone.restapi = 8.43.4 RestrictedPython = 6.2 Zope = 5.8.5

Plone 6.0.3/6.0.4

AccessControl = 6.2 plone.namedfile = 6.0.3 plone.rest = 3.0.1 plone.restapi = 8.43.4 RestrictedPython = 6.2 Zope = 5.8.5

Plone 6.0.5/6.0.6

AccessControl = 6.2 plone.namedfile = 6.1.3 plone.rest = 3.0.1 plone.restapi = 8.43.4 RestrictedPython = 6.2 Zope = 5.8.5

-- Maurits van Rees https://maurits.vanrees.org/ Plone/Zope Security Team

Impact When the ++api++ traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive.

Patches Patches will be released in plone.rest 2.0.1 and 3.0.1. Series 1.x is not affected.

Workarounds In your frontend web server (nginx, Apache) you can redirect /++api++/++api++ to /++api++.

Impact There is a stored cross site scripting vulnerability for SVG images. A security hotfix from 2021 already partially fixed this, by making sure SVG images are always downloaded instead of shown inline. But the same problem still exists for scales of SVG images.

Note that an image tag with an SVG image as source is not vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an image, and then trick a user into following a specially crafted link.

All versions of plone.namedfile are impacted.

Patches Patches will be released in various plone.namedfile releases:

5.6.1 (for Plone 5.2) 6.0.3 (for Plone 6.0.0-6.0.4) 6.1.3 (for Plone 6.0.5-6.0.6) 6.2.1 (for Plone 6.0.7)

Workarounds There is no workaround.

An issue in Plone CMS allows attacker to access sensitive information via the RSS feed protlet.

Volto is a ReactJS-based frontend for the Plone Content Management System. Between versions 14.0.0-alpha.5 and 15.0.0-alpha.0, a user could have their authentication cookie replaced with an authentication cookie from another user, effectively giving them control of the other user's account and privileges. This occurs when using an outdated version of the react-cookie library and a server is under high load. A proof of concept does not currently exist, but it is possible for this issue to occur in the wild. The patch and fix is present in Volto 15.0.0-alpha.0. As a workaround, one may manually upgrade the react-cookie package to 4.1.1 and then override all Volto components that use this library.

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the imageviewfullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings.

Patches A new version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7.

Note that the Products.CMFPlone package has the same problem in the 4.3 series. plone.app.contenttypes has the same problem in all versions, see advisory. For all unpatched versions of the three packages, you can use the following workaround.

Workaround Make sure the imageviewfullscreen page is not stored in the cache. In Plone:

Login as Manager and go to Site Setup. Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable. Click on the tab 'Caching operations'. Under 'Legacy template mappings' locate the ruleset 'Content item view'. From the last column ('Templates') remove 'imageviewfullscreen'. Click on Save.

Reporter This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you!

For more information If you have any questions or comments about this advisory, email us at security@plone.org This is also the correct address to use when you want to report a possible vulnerability. See our security report policy.

Impact Various parts of Plone use the 'is url in portal' check for security, mostly to see if it is safe to redirect to a url. A url like https://example.org is not in the portal. But the url https:example.org without slashes tricks our code and it is considered to be in the portal. When redirecting, some browsers go to https://example.org, others give an error. Attackers may use this to redirect you to their site, especially as part of a phishing attack.

Patches The problem has been patched in Products.isurlinportal 1.2.0. This is a recommended upgrade for all users of Plone 4.3 and 5, on Python 2.7 or higher. It has not been tested on earlier Plone or Python versions. Upcoming Plone 5.2.5 and higher will include the new version.

Discovered This vulnerability was discovered and reported by Yuji Tounai of Mitsui Bussan Secure Directions, Inc. Thank you!

For more information If you have any questions or comments about this advisory: Email the Plone Security Team at security@plone.org, especially when you think you have discovered a security problem or when you are not sure. Open an issue in the tracker if your question or comment can be public.

In Plone 5.0 through 5.2.4, Editors are vulnerable to XSS in the folder contents view, if a Contributor has created a folder with a SCRIPT tag in the description field.

Zope Products.CMFCore before 2.5.1 and Products.PluggableAuthService before 2.6.2, as used in Plone through 5.2.4 and other products, allow Reflected XSS.

Plone through 5.2.4 allows XSS via a full name that is mishandled during rendering of the ownership tab of a content item.

Plone through 5.2.4 allows remote authenticated managers to perform disk I/O via crafted keyword arguments to the ReStructuredText transform in a Python script.

Plone through 5.2.4 allows remote authenticated managers to conduct SSRF attacks via an event ical URL, to read one line of a file.

Plone though 5.2.4 allows SSRF via the lxml parser. This affects Diazo themes, Dexterity TTW schemas, and modeleditors in plone.app.theming, plone.app.dexterity, and plone.supermodel.

Plone through 5.2.4 allows stored XSS attacks (by a Contributor) by uploading an SVG or HTML document.

Plone through 5.2.4 allows XSS via the inlinediff methods in Products.CMFDiffTool.

Impact Most Python modules are not available for using in TAL expressions that you can add through-the-web, for example in Zope Page Templates. This restriction avoids file system access, for example via the 'os' module. But some of the untrusted modules are available indirectly through Python modules that are available for direct use.

By default, you need to have the Manager role to add or edit Zope Page Templates through the web. Only sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk.

Patches The problem has been fixed in Zope 5.2 and 4.6.

Workarounds A site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.

For more information If you have any questions or comments about this advisory: Open an issue in the Zope issue tracker Email us at security@plone.org

Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when being echoed back to the user. This data can be interpreted as executable code by the browser and allows an attacker to execute JavaScript in the context of the victim's browser if the victim opens a vulnerable page containing an XSS payload.

A stored cross-site scripting (XSS) vulnerability in Plone CMS 5.2.3 exists in site-controlpanel via the "form.widgets.sitetitle" parameter.

Impact What kind of vulnerability is it? Who is impacted?

Information disclosure vulnerability - everyone can list the names of roles defined in the ZODB Role Manager plugin if the site uses this plugin.

Patches Has the problem been patched? What versions should users upgrade to?

The problem has been fixed in version 2.6.0. Depending on how you have installed Products.PluggableAuthService, you should change the buildout version pin to 2.6.0 and re-run the buildout, or if you used pip simply do pip install "Products.PluggableAuthService>=2.6.0"

Workarounds Is there a way for users to fix or remediate the vulnerability without upgrading?

There is no workaround. Users are encouraged to upgrade.

References Are there any links users can visit to find out more?

- GHSA-p75f-g7gx-2r7p - Products.PluggableAuthService on PyPI

For more information If you have any questions or comments about this advisory: Open an issue in the Products.PluggableAuthService issue tracker Email us at security@plone.org

Plone before 5.2.3 allows XXE attacks via a feature that is protected by an unapplied permission of plone.schemaeditor.ManageSchemata (therefore, only available to the Manager role).

Plone before 5.2.3 allows SSRF attacks via the tracebacks feature (only available to the Manager role).

Plone before 5.2.3 allows XXE attacks via a feature that is explicitly only available to the Manager role.

The official plone Docker images before version of 4.3.18-alpine (Alpine specific) contain a blank password for a root user. System using the plone docker container deployed by affected versions of the docker image may allow a remote attacker to achieve root access with a blank password.