Security advisory for Products.isurlinportal

Announcements Security
1

This is a copy of an advisory published on GitHub today.

Possible open redirect when using more than 2 forward slashes

Impact

A url /login?came_from=////evil.example may redirect to an external website after login.

Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.

Patches

The problem has been patched in Products.isurlinportal.

  • Plone 6.2: upgrade to Products.isurlinportal 4.0.0.
  • Plone 6.1: upgrade to Products.isurlinportal 3.1.0.
  • Plone 6.0: upgrade to Products.isurlinportal 2.1.0.
  • Older Plone versions don't have security support anymore.

Workarounds

There are no known workarounds.

Background

When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.

This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.

The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.

This was discovered during a penetration test by the CERT-EU Team.

Thank you @alert for contacting me for the Plone Security Team and supplying a fix.

3 Likes
2

If someone is using buildout like me and don't want to rebuild everything, what I suggest it to edit buildout.cfg and add the above fixed version in the [versions] part. Then doing a buildout install will update the installation with the new Products.isurlinportal version. In my case, for example, it is: buildout -N install client1 client2 client3 client4 (-N is there to protect about unwanted egg upgrades). As usual, test it before in a test installation, buildout does not have a dry run option.

Note: on an instance, being the fix very small, I've found the Products.isurlinportal path in the bin/instance or bin/client1 source (just search for Products.isurlinportal), then cd in its directory, went in Products/isurlinportal and edited __init__.py, applying the fix: https://github.com/plone/Products.isurlinportal/commit/2aff27cbcaa924e09edc68597f00dc054e3823a4#diff-e6d7cb3549e16fa55a4c61d0faf8e50af5bc7ab02b5271c01d2449f7d7933f92. Then I've restarted Plone.