Products.PloneHotfix20210518 1.0

Plone hotfix, 2020-01-21

This hotfix fixes several security issues:

• Remote Code Execution via traversal in expressions. Reported by David Miller.

• Writing arbitrary files via docutils and Python Script. Reported by Calum Hutton.

• Stored XSS from file upload (svg, html). Reported separately by Emir Cüneyt Akkutlu and Tino Kautschke.

• XSS vulnerability in CMFDiffTool. Reported by Igor Margitich.

• Reflected XSS in various spots. Reported by Calum Hutton.

• Various information disclosures: GS, QI, all_users. Reported by Calum Hutton.

• Stored XSS from user fullname. Reported by Tino Kautschke.

• Blind SSRF via feedparser accessing an internal URL. Reported by Subodh Kumar Shree.

• Server Side Request Forgery via event ical URL. Reported by MisakiKata and David Miller.

• Server Side Request Forgery via lxml parser. Reported by MisakiKata and David Miller.

Compatibility

This hotfix should be applied to the following versions of Plone:

• Plone 5.2.4 and any earlier 5.2.x version

• Plone 5.1.7 and any earlier 5.1x version

• Plone 5.0.10 and any earlier 5.0.x version

• Plone 4.3.20 and any earlier 4.x version

The hotfix is officially supported by the Plone security team on the following versions of Plone in accordance with the Plone version support policy: 4.3.20, 5.0.10, 5.1.7 and 5.2.4.

On Plone 4.3, 5.0 and 5.1 the hotfix is officially only supported on Python 2.7. On Plone 5.2.X it is supported on Python 2.7 and Python 3.6/3.7/3.8.

The fixes included here will be incorporated into subsequent releases of Plone, so Plone 5.2.5 and greater should not require this hotfix.

Installation

Installation instructions can be found at https://plone.org/security/hotfix/20210518

Q&A

Q: How can I confirm that the hotfix is installed correctly and my site is protected?

A: On startup, the hotfix will log a number of messages to the Zope event log that look like this:

2021-05-18 14:07:24,176 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied expressions patch
2021-05-18 14:07:24,179 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied genericsetup patch
2021-05-18 14:07:24,181 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied pas patch
2021-05-18 14:07:24,182 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied propertymanager patch
2021-05-18 14:07:24,183 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied skinnable patch
2021-05-18 14:07:24,187 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied xmlrpc_dump_instance patch
2021-05-18 14:07:24,188 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied difftool patch
2021-05-18 14:07:24,238 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied event patch
2021-05-18 14:07:24,244 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied modeleditor patch
2021-05-18 14:07:24,246 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied namedfile patch
2021-05-18 14:07:24,283 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied pa_users patch
2021-05-18 14:07:24,367 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied portlets patch
2021-05-18 14:07:24,369 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied publishing patch
2021-05-18 14:07:24,371 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied qi patch
2021-05-18 14:07:24,372 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied supermodel patch
2021-05-18 14:07:24,500 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied theming patch
2021-05-18 14:07:24,634 INFO    [Products.PloneHotfix20210518:43][MainThread] Applied transforms patch
2021-05-18 14:07:24,634 INFO    [Products.PloneHotfix20210518:51][MainThread] Hotfix installed

The exact number of patches applied, will differ depending on what packages you are using. If a patch is attempted but fails, it will be logged as an error that says “Could not apply”. This may indicate that you have a non-standard Plone installation. Please investigate, and mail us the accompanying traceback if you think it is a problem in the hotfix.

Q: How can I report problems installing the patch?

A: Contact the Plone security team at security@plone.org or visit the Gitter channel at https://gitter.im/plone/public and the forum at https://community.plone.org

Q: How can I report other potential security vulnerabilities?

A: Please email the security team at security@plone.org rather than discussing potential security issues publicly.

Changelog

1.0 (2021-05-18)

• Initial release