Plone security hotfix 20261110

Announcements Security
1

Plone security fix 20261110: remote code execution

On behalf of the Plone/Zope Security Team: today we release fixes for a remote code execution vulnerability in Plone.
We announced this last week in the pre-announcement.

All supported Plone versions are affected: 6.0, 6.1 and 6.2.
Older versions are affected as well, back to at least Plone 4.3.

Please update now.
Details are public from today, and with current AI tools it may not take long to turn them into a working exploit.

What is the problem?

It is a chain of several issues, which together let an anonymous visitor run code on the server.

  • Products.CMFEditions: the conditional modifiers in portal_modifier had no security declarations.
    An anonymous visitor could change the TALES condition of a modifier, and then run it.
    This condition is also evaluated when an editor saves versioned content, so even on its own it lets an attacker run code with the privileges of that editor.
  • Products.CMFPlone, Products.MimetypesRegistry and plone.batching opened whole modules to restricted code with allow_module.
    This also exposed everything these modules import.
    This allowed restricted code (TALES expressions, Python Scripts) to escape the sandbox and reach modules like os.
  • plone.restapi opened the json module from the standard library to restricted code.
    Some of its functions could be used to call protected methods on any object, without having the needed permission.

Thanks to Mokrane ABDELMALEK for reporting this, via the Ghent University VDP programme.
Thanks also to Andreas Jung for sharing extra ideas on what should be fixed.

Security advisories

CVE numbers have been requested and will be added to the advisories when they are assigned.

How to fix this

You have two options:

  1. Plone 6.0, 6.1 and 6.2: update the package versions listed below.
    This is the recommended way.
  2. Any Plone version from 4.3 to 6.2: install the hotfix package Products.PloneHotfix20261110. You may need to spell this as products-plonehotfix20261110 if you have an old setuptools/buildout/pip version.

Restart all Zope instances afterwards.

Since one of the vulnerabilities is in Products.CMFPlone, we will also make full new releases of the 6.0, 6.1, and 6.2 series, including Docker images. These won't be security-only, but include bug fixes. They should be ready later today.

The workaround from the pre-announcement, blocking all urls that contain portal_modifier in your web server, is still a good idea.
You can keep it in place after updating.

Package versions

These are in Buildout notation.
If you use a pip constraints file, use a double equals sign, for example Products.CMFPlone==6.2.3.

Plone 6.2

Products.CMFPlone = 6.2.3
Products.CMFEditions = 5.0.2
Products.MimetypesRegistry = 4.0.2
plone.batching = 3.0.3
plone.restapi = 10.2.1

Plone 6.1

Products.CMFPlone = 6.1.6
Products.CMFEditions = 4.0.7
Products.MimetypesRegistry = 3.0.2
plone.batching = 2.0.8
plone.restapi = 9.15.8

Plone 6.0

Products.CMFPlone = 6.0.16
Products.CMFEditions = 4.0.7
Products.MimetypesRegistry = 3.0.2
plone.batching = 2.0.8
plone.restapi = 9.15.8

If you do not use plone.restapi, you can skip that one.

Hotfix

The hotfix Products.PloneHotfix20261110 works on Plone 4.3, 5.0, 5.1, 5.2, 6.0, 6.1 and 6.2, on Python 2.7 and Python 3.
See its page on PyPI for installation instructions.

When you use the fixed versions of all the packages above, you do not need the hotfix, but it does no harm either.

Plone 5.2 and older have been out of security support for several years.
For this fix we made an exception, because of the severity.
If you still use such a version, your site likely has other known vulnerabilities, and you should upgrade to Plone 6 soon.

Check whether your site was attacked

A changed modifier condition stays in the database, also after you install the fix.
So please check this, especially if you did not block portal_modifier before today.

  • With the updated Products.CMFEditions: log in as Manager and go to @@check-modifier-conditions on the Plone site root, for example https://example.org/@@check-modifier-conditions.
    This compares the conditions in portal_modifier with the defaults, and lets you revert changed ones.
  • With the hotfix: on startup, the hotfix checks the conditions in all Plone sites.
    If a condition differs from the default, it logs a warning with POSSIBLE ATTACK: MODIFIED VERSIONING CONDITIONS FOUND.
    Otherwise it logs No changed modifier conditions found.

A difference does not necessarily mean that your site was attacked.
The defaults have changed a bit over time, so your site may have an old default.
Or an add-on or an admin changed it for a valid reason.
But if you do not recognize the condition, treat your server as compromised.

Possible incompatibilities

Restricted code can now only import the names that Plone itself needs from these modules.
If your own Python Scripts or templates import other names from Products.CMFPlone, Products.CMFPlone.utils, Products.CMFPlone.browser.navtree, OFS.ObjectManager, Products.MimetypesRegistry.common or plone.batching, they now get an Unauthorized error.
With the updated plone.restapi the same is true for anything from the json module.
The hotfix still allows json.dumps and json.loads.

You can fix this by declaring the names you need in your own add-on, for example:

from AccessControl import ModuleSecurityInfo

ModuleSecurityInfo("json").declarePublic("dumps", "loads")

Never use allow_module for this.

Questions

If you have problems with the installation, or see regressions, please reply to this post.

If you have a security-sensitive question, or you find further security problems, please mail the Plone/Zope Security Team at security@plone.org.

12 Likes
Plone 6.0.16 released
Plone 6.2.3 released
Pre-announcement: Plone security fix 20261110
Plone 6.1.6 released
2

Is this correct?

image
image1536Ă—1024 457 KB

3

nothing important but in Plone 6.1 you will be asked to upgrade but there's no upgrade step, so you get the warning "No upgrade steps are available." and the message to upgrade will stay there in the control panel.

4

I don’t understand why you would ask if that’s correct in a public space, if you’re unsure

5

The issues have been fully disclosed and all information is publicly available.

A major attach vector has already been indirectly disclosed through the announcement one week ago. The information from the workaround with "portal_modifier" already revealed a path for an exploit within 30 minutes and the cheapest Chinese AI.

There is nothing more to hide and there is no information that isn't already known. In fact, this graphic has been generated from the CVE information..everyone can do the same.

6

Full releases of Plone 6.0.16, 6.1.6, and 6.2.3 are now available. Release notes, versions, and constraints are here:

Docker backend images will be created later, and separate announcements made.

4 Likes
7

This indeed a new problem. As soon as you give a rough hint its enough to dig into it in under an hour.

8

If you have old Plone sites running (like 4.3 - 5.1) :face_with_peeking_eye: and are a lucky owner of an docker image only, here a way to patch:

New Dockerfile.hotfix plus a local version of the hotfix directory in current dir:

ARG BASE
FROM ${BASE}
ARG RUNUSER
USER root
COPY --chown=plone PloneHotfix20261110 /plone/hotfix-products/PloneHotfix20261110
RUN printf "\nproducts /plone/hotfix-products\n" >> /plone/buildout/parts/instance/etc/zope.conf
USER ${RUNUSER}

build it

docker build -f Dockerfile.hotfix --build-arg BASE=<OLDIMAGE> --build-arg RUNUSER=<user> -t <repo>:hotfix20261110 .

Then push it to your registry or whatever way you distribute it and run the fresh one.

1 Like
9

I use container-backend/Dockerfile at v6.2.2.1 · plone/container-backend · GitHub for my plone site. I don't see a more recent version than 6.2.2.1 which is what I installed a week ago. Could someone please help me by telling me how to install the security patch while using a docker container?

The hotfix announcement has: "Since one of the vulnerabilities is in Products.CMFPlone, we will also make full new releases of the 6.0, 6.1, and 6.2 series, including Docker images. These won't be security-only, but include bug fixes. They should be ready later today." It sounds like I need to wait for these to be released. Or, is there a better option.

Thanks, Michael

10

Note that you may want to add Products.DisableXMLRPC · PyPI as well on Plone 4 and 5.

11

Is anyone else seeing a message with the text: "Warning The site configuration is outdated and needs to be upgraded. Please continue with the upgrade." in their Site Setup? That's not really the problem though, when I click the link to perform the process it mentions, I am shown the "Upgrade this site" page, but the "Upgrade" button cannot be pressed, showing the following message above it: "No upgrade steps are available."

1 Like
12

i didn't see that, but @yurj up here mentioned it :wink:

13

That is because you have a newer Products.CMFPlone, but not a newer plone.app.upgrade. If you use the complete new release (6.0.16, 6.1.6, or 6.2.3), the upgrade steps will be there. Meanwhile, this should be no problem, you can ignore it. But going for the full upgrade soon would be good, especially if you have made a bigger leap in the Products.CMFPlone version number, say from 6.2.0 to 6.2.3 directly. We may have wanted to warn about that.

Background:

  • Products.CMFPlone has a metadata.xml with a profile version number. In each release I update it, whether there already is an actual upgrade step needed or not.
  • The upgrade steps for updating a site to a new profile version number are added in a separate package, plone.app.upgrade. Between Plone 6.2.2 and 6.2.3, the only upgrade step is a dummy one, so nothing needs changing.
  • But a few other core packages have their own upgrade steps. The "Upgrade this site" page would run those steps as well, but they are only triggered when the plone.app.upgrade package has an upgrade.
  • As alternative to the "Upgrade this site" page, you can go to portal_setup in the ZMI, to the Upgrades tab, and run any upgrades there.
14

I was able to install 6.2.3 from Docker. Thank you everyone for finding the vulnerability, providing a security update for it, and doing such and excellent job communicating about it and how to fix it!

Best Regards, Michael

3 Likes
16

Full releases of Plone 6.0.16, 6.1.6, and 6.2.3 are now available on Docker (plone-backend image mostly). Announcements here on the forum:

3 Likes
17

A big thank you to you @mauritsvanrees and all the marvelous people in the security team!

7 Likes
18

Thanks for the hard work on the hotfix. But I am confused regarding the workaround in the pre-announcement.

Are sites that block all access to portal_modifer (including xml-rpc) but do not have the hotfix or the newest version safe and upgrading to the new versions can wait? Or is that just a workaround for one of the five security-issues that are adressed by the hotfix?

19

Blocking access to portal_modifier (including XML-RPC) mitigates the specific issue that was reported, but I wouldn’t consider it a full fix.

Besides closing that issue, the hotfix and the updated packages also harden security in several other areas. We can’t rule out other ways to reach the same weaknesses that don’t go through portal_modifier.

So in my opinion the best approach is still to apply the hotfix or upgrade as soon as possible, and to treat the block only as a temporary measure until then.

Also keep in mind that the block only protects against external access (e.g. at the proxy level). Requests that reach the backend directly, from the internal network, are still exposed.