Closed mauritsvanrees closed 3 years ago
As discussed in the security team today, I have created a public repository with the hotfix code: https://github.com/plone/Products.PloneHotfix20210518
This includes the tests. Now people outside of the security team can create PRs for the related packages. You are very welcome to do so. Please assign me as reviewer of the PR when you do so.
All PRs are merged.
All releases are made, except for Products.CMFPlone
.
The changes from the May 18 hotfix should be merged to core to be available in 5.2 and 6.0.
Anyone could make PRs for this. The internal repository of the hotfix has tests for each though, so it may be good if someone from the @plone/security-team creates the PR. But if someone else starts a PR, we can always copy tests to it later. If you create a PR, please ask me for a review. Help is certainly welcome!
Remote Code Execution via traversal in expressions
expressions.py
view/__name__
is allowed as special case in the hotfix, but not in Zope. This is used inplone.app.caching
, and maybe other places, so those should be fixed. Actually, in a template from a browser view this is no problem: trusted traverse is used, which happily accepts this. If you customise the template viaportal_view_customizations
, you get a 404. But replacing__name__
just leads to a similar error in a different part of the customized template, using the main_template master macro. So basically, we would only need to fix templates within skin directories. But those should be turned into browser view templates anyway (looking at you, CMFEditions, and three skin directories in CMFPlone).Writing arbitrary files via docutils and Python Script
transforms.py
Products.PortalTransforms
master. PR: https://github.com/plone/Products.PortalTransforms/pull/45Information disclosures: mostly installation logs
genericsetup.py
,pas.py
,qi.py
,xmlrpc_dump_instance.py
qi.py
.Stored XSS from file upload (svg, html)
namedfile.py
plone.namedfile
master. PR: https://github.com/plone/plone.namedfile/pull/99Reflected XSS in various spots
skinnable.py
,propertymanager.py
,publishing.py
,pas.py
propertymanager.py
andpublishing.py
need to be merged intoProducts.CMFPlone:patches/publishing.py
. PR: https://github.com/plone/Products.CMFPlone/pull/3281propertymanager.py
andpublishing.py
need to be merged intoProducts.CMFPlone:patches/publishing.py
. PR: https://github.com/plone/Products.CMFPlone/pull/3282XSS vulnerability in CMFDiffTool
difftool.py
Stored XSS from user fullname
pa_users.py
plone.app.users
2.6.x.plone.app.users
master.innerText
is used. That was not feasible in a hotfix though. I created an issue inmockup
.mockup
3.x andplone.staticresources
1.xmockup
master andplone.staticresources
masterplone.app.vocabularies
, which I think is where the users vocabulary comes from, by calling the safe html transform on fullnames. Ah, no, this is inplone.app.content.browser.vocabulary
. So we fix it there, together with the fix for the folder contents at the bottom of this comment:plone.app.content
3.x. PR: https://github.com/plone/plone.app.content/pull/229plone.app.content
master. PR: https://github.com/plone/plone.app.content/pull/230plone.app.content
3.8.8 and 4.0.0a3.Blind SSRF via feedparser accessing an internal URL
portlets.py
isURLInPortal
.plone.app.portlets
4.4.x. PR https://github.com/plone/plone.app.portlets/pull/149plone.app.portlets
master. PR https://github.com/plone/plone.app.portlets/pull/150Server Side Request Forgery via event ical URL
event.py
isURLInPortal
.plone.app.event
3.2.x. PR: https://github.com/plone/plone.app.event/pull/335plone.app.event
master. PR: https://github.com/plone/plone.app.event/pull/336plone.app.event
3.2.12 and 4.0.0a4Server Side Request Forgery via lxml parser
modeleditor.py
,supermodel.py
,theming.py
. But the modeleditor and supermodel fix were already in releases from November. They were included in the hotfix to make these similar fixes available for older versions.plone.app.dexterity
2.6.x was already fixed last year in 2.6.8.plone.app.dexterity
master: has the same fix.plone.supermodel
master already fixes last year in 1.6.3.plone.app.theming
4.1.x. PR: https://github.com/plone/plone.app.theming/pull/197plone.app.theming
master PR: https://github.com/plone/plone.app.theming/pull/198plone.app.theming
4.1.7 and 5.0.0a1Stored XSS in folder contents
content.py
plone.app.content
3.x. PR: https://github.com/plone/plone.app.content/pull/229plone.app.content
master. PR: https://github.com/plone/plone.app.content/pull/230