====================================================================

                             CERT-Renater

                 Note d'Information No. 2020/VULN034
_____________________________________________________________________

DATE                : 22/01/2020

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Plone versions All supported.

=====================================================================
https://plone.org/security/hotfix/20200121
https://plone.org/security/hotfix/20200121/privilege-escalation-when-plone-restapi-is-installed
https://plone.org/security/hotfix/20200121/sql-injection-in-dtml-or-in-connection-objects
https://plone.org/security/hotfix/20200121/xss-in-the-title-field-on-plone-5-0-and-higher
https://plone.org/security/hotfix/20200121/privilege-escalation-for-overwriting-content
https://plone.org/security/hotfix/20200121/an-open-redirection-on-the-login-form-and-possibly-other-places
https://plone.org/security/hotfix/20200121/password-strength-checks-were-not-always-checked
_____________________________________________________________________

A Plone security hotfix was released today.

CVE numbers: not yet issued. We will request them shortly from mitre.org.

Versions Affected: All supported Plone versions (4.3.15 and any earlier
4.x version, 5.2.1 and any earlier 5.x version). Previous versions could
be affected but have not been tested.

Versions Not Affected: None.

Nature of vulnerability:

The patch addresses several security issues:

- Privilege escalation when plone.restapi is installed. Reported and
fixed by Lukas Graf and Niklaus Johner.
- An open redirection on the login form and possibly other places where
redirects are done.
- The isURLInPortal check that is done to avoid linking to an external
site could be tricked into accepting malicious links. Reported by
Damiano Esposito.
- Password strength checks were not always checked. Reported by Ben Kummer.
- You might be able to PUT (overwrite) some content without needing
write permission.
   This seems hard to do in practice. This fix is only needed when you
use plone.app.contenttypes. Reported and fixed by Alessandro Pisa.
- SQL quoting in DTML or in connection objects was insufficient, leading
to possible SQL injections. This is a problem in Zope. If you use Zope
without Plone, this hotfix should work for you too. Reported and fixed
by Michael Brunnbauer and Michael Howitz.
- Cross Site Scripting (XSS) in the title field on plone 5.0 and higher.
Reported by Marcos Valle.

Version support: The hotfix is officially supported by the Plone
security team on the following versions of Plone in accordance with the
Plone version support policy: 4.3.19, and 5.0.10, 5.1.6, 5.2.1. It was
also tested on Plone 4.2.7. It is recommended also for Plone 4.0 and
4.1, but this has not been tested.

The fixes included here will be incorporated into subsequent releases of
Plone, so Plone 4.3.20, 5.1.7, 5.2.2 and greater should not require this
hotfix.

The above is a copy from the release notes.
Full details: https://plone.org/security/hotfix/20200121


Maurits van Rees https://maurits.vanrees.org/
Member of Plone Security Team
_____________________________________________________________________

Privilege escalation when plone.restapi is installed


Versions affected

    5.2.1
    5.2.0


Vulnerability

Sites using plone.restapi allow for users with a certain privilege level
to escalate their privileges up to the highest level. A site is only
vulnerable when plone.restapi is installed in the add-ons (modules)
control panel. plone.restapi is included since Plone version 5.2, but
not installed by default.


Current status

Patched


Credits

Discovered by

    Lukas Graf
    Niklaus Johner


Fixed by

    Lukas Graf
    Niklaus Johner


Coordinated by

    Plone Security Team

_____________________________________________________________________

SQL injection in DTML or in connection objects
Versions affected

    5.2.1
    5.2.0
    5.1.6
    5.1.5
    5.1.4
    5.1.2
    5.1.1
    5.1
    5.1rc2
    5.1rc1
    5.1b4
    5.1b3
    5.1b2
    5.1a2
    5.1a1
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    5.0.1
    5.0
    5.0rc3
    5.0rc2
    5.0rc1
    4.3.19
    4.3.18
    4.3.17
    4.3.15
    4.3.14
    4.3.12
    4.3.11
    4.3.10
    4.3.9
    4.3.8
    4.3.7
    4.3.6
    4.3.5
    4.3.4
    4.3.3
    4.3.2
    4.3.1
    4.3
    4.2.7
    4.2.6
    4.2.5
    4.2.4
    4.2.3
    4.2.2
    4.2.1
    4.2
    4.1.6
    4.1.5
    4.1.4
    4.1.3
    4.1.2
    4.1.1
    4.1
    4.0.10
    4.0.9
    4.0.8
    4.0.7
    4.0.5
    4.0.4
    4.0.3
    4.0.2
    4.0.1
    4.0

Vulnerability

SQL quoting in DTML or in connection objects was insufficient, leading
to possible SQL injections. RelStorage is not affected. This is a
problem in Zope. This hotfix will be sufficient to patch Zope sites that
don't use Plone. Note that there is code in Plone that connects to an
SQL database, this is only exploitable on highly customised sites.


Current status

Patched


Credits

Discovered by

    Michael Brunnbauer
    Michael Howitz


Fixed by

    Michael Brunnbauer
    Michael Howitz


Coordinated by

    Plone Security Team

_____________________________________________________________________

XSS in the title field on plone 5.0 and higher.


Versions affected

    5.2.1
    5.2.0
    5.1.6
    5.1.5
    5.1.4
    5.1.2
    5.1.1
    5.1
    5.1rc2
    5.1rc1
    5.1b4
    5.1b3
    5.1b2
    5.1a2
    5.1a1
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    5.0.1
    5.0
    5.0rc3
    5.0rc2
    5.0rc1


Vulnerability

A user with Editor or Contributor permissions can create a Folder and
put JavaScript in the title. In most places this JavaScript is escaped
to be harmless. But in Plone 5.2 it may end up unescaped in the global
navigation. And in Plone 5.0 and higher it may end up unescaped in the
breadcrumbs of the folder contents page.


Current status

Patched


Credits

Discovered by

    Marcos Valle


Fixed by

    Plone Security Team


Coordinated by

    Plone Security Team

_____________________________________________________________________

Privilege escalation for overwriting content
Versions affected

    5.2.1
    5.2.0
    5.1.6
    5.1.5
    5.1.4
    5.1.2
    5.1.1
    5.1
    5.1rc2
    5.1rc1
    5.1b4
    5.1b3
    5.1b2
    5.1a2
    5.1a1
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    5.0.1
    5.0
    5.0rc3
    5.0rc2
    5.0rc1
    4.3.19
    4.3.18
    4.3.17
    4.3.15
    4.3.14
    4.3.12
    4.3.11
    4.3.10
    4.3.9
    4.3.8
    4.3.7
    4.3.6
    4.3.5
    4.3.4
    4.3.3
    4.3.2
    4.3.1
    4.3


Vulnerability

You might be able to PUT (overwrite) some content without needing write
permission. This seems hard to do in practice though. This fix is only
needed when you use plone.app.contenttypes.


Current status

Patched


Credits

Discovered by

    Alessandro Pisa


Fixed by

    Alessandro Pisa


Coordinated by

    Plone Security Team

_____________________________________________________________________

An open redirection on the login form and possibly other places

Versions affected

    5.2.1
    5.2.0
    5.1.6
    5.1.5
    5.1.4
    5.1.2
    5.1.1
    5.1
    5.1rc2
    5.1rc1
    5.1b4
    5.1b3
    5.1b2
    5.1a2
    5.1a1
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    5.0.1
    5.0
    5.0rc3
    5.0rc2
    5.0rc1
    4.3.19
    4.3.18
    4.3.17
    4.3.15
    4.3.14
    4.3.12
    4.3.11
    4.3.10
    4.3.9
    4.3.8
    4.3.7
    4.3.6
    4.3.5
    4.3.4
    4.3.3
    4.3.2
    4.3.1
    4.3
    4.2.7
    4.2.6
    4.2.5
    4.2.4
    4.2.3
    4.2.2
    4.2.1
    4.2
    4.1.6
    4.1.5
    4.1.4
    4.1.3
    4.1.2
    4.1.1
    4.1
    4.0.10
    4.0.9
    4.0.8
    4.0.7
    4.0.5
    4.0.4
    4.0.3
    4.0.2
    4.0.1
    4.0


Vulnerability

An open redirection on the login form and possibly other places where
redirects are done. The isURLInPortal check that is done to avoid
linking to an external site could be tricked into accepting malicious
links.


Current status

Patched


Credits

Discovered by

    Damiano Esposito


Fixed by

    Plone Security Team


Coordinated by

    Plone Security Team

_____________________________________________________________________

Password strength checks were not always checked.


Versions affected

    5.2.0
    5.1.6
    5.1.5
    5.1.4
    5.1.2
    5.1.1
    5.1
    5.1rc2
    5.1rc1
    5.1b4
    5.1b3
    5.1b2
    5.1a2
    5.1a1
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    5.0.1
    5.0
    5.0rc3
    5.0rc2
    5.0rc1
    4.3.19
    4.3.18
    4.3.17
    4.3.15
    4.3.14
    4.3.12
    4.3.11
    4.3.10
    4.3.9
    4.3.8
    4.3.7
    4.3.6
    4.3.5
    4.3.4
    4.3.3
    4.3.2
    4.3.1
    4.3


Vulnerability

Some places that should have checked the strength of a password, did not
do this. When registering yourself anonymously, it was checked
correctly. But depending on your Plone version, the password reset form
or the admin form for adding a new user missed this check.


Current status

Patched


Credits

Discovered by

    Ben Kummer


Fixed by

    Plone Security Team


Coordinated by

    Plone Security Team



=========================================================
+ CERT-RENATER        | tel : 01-53-94-20-44            +
+ 23/25 Rue Daviel    | fax : 01-53-94-20-41            +
+ 75013 Paris         | email:cert@support.renater.fr   +
=========================================================