Products.PloneHotfix20210518 1.6

Description:

Products.PloneHotfix20210518 1.6

Plone hotfix, 2021-05-18
This hotfix fixes several security issues:

Remote Code Execution via traversal in expressions via aliases.
Reported by David Miller.
Remote Code Execution via traversal in expressions (no aliases).
Reported by Calum Hutton.
Remote Code Execution via traversal in expressions via string formatter.
Reported by David Miller.
Writing arbitrary files via docutils and Python Script.
Reported by Calum Hutton.
Stored XSS from file upload (svg, html).
Reported separately by Emir Cüneyt Akkutlu and Tino Kautschke.
XSS vulnerability in CMFDiffTool.
Reported by Igor Margitich.
Reflected XSS in various spots.
Reported by Calum Hutton.
Various information disclosures: GS, QI, all_users.
Reported by Calum Hutton.
Stored XSS from user fullname.
Reported by Tino Kautschke.
Blind SSRF via feedparser accessing an internal URL.
Reported by Subodh Kumar Shree.
Server Side Request Forgery via event ical URL.
Reported by MisakiKata and David Miller.
Server Side Request Forgery via lxml parser.
Reported by MisakiKata and David Miller.
XSS in folder contents on Plone 5.0 and higher.
Reported by Matt Moreschi.
Only included since version 1.5 of the hotfix.
Remote Code Execution via Python Script.
Reported by Calum Hutton.
Only Plone 5.2 on Python 3 is vulnerable.
Only included since version 1.6 of the hotfix.



Compatibility
This hotfix should be applied to the following versions of Plone:

Plone 5.2.4 and any earlier 5.2.x version
Plone 5.1.7 and any earlier 5.1x version
Plone 5.0.10 and any earlier 5.0.x version
Plone 4.3.20 and any earlier 4.x version

The hotfix is officially supported by the Plone security team on the
following versions of Plone in accordance with the Plone
version support policy: 4.3.20, 5.0.10, 5.1.7 and 5.2.4.
On Plone 4.3, 5.0 and 5.1 the hotfix is officially only supported on Python 2.7.
On Plone 5.2.X it is supported on Python 2.7 and Python 3.6/3.7/3.8.
The fixes included here will be incorporated into subsequent releases of Plone,
so Plone 5.2.5 and greater should not require this hotfix.


Zope
Zope is also affected.
New versions for Zope and other packages are available.
Upgrading to those is the recommended way.
If you cannot upgrade yet, you can try the Plone hotfix.
It has not been tested on Zope only, but we try not to let the Plone-specific code get in the way, so it should be okay.
These vulnerabilities mentioned above are relevant for Zope:

Remote Code Execution via traversal in expressions via aliases.
Fixes released in Zope 4.6 and 5.2.
Remote Code Execution via traversal in expressions (no aliases).
Fixes released in Zope 4.6.1 and 5.2.1.
Various information disclosures.
Fixes released in Products.PluggableAuthService 2.6.0, Products.GenericSetup 2.1.1, and Zope 4.5.5.
Reflected XSS in various spots.
Fixes released in Products.CMFCore 2.5.1 and Products.PluggableAuthService 2.6.2.
Remote Code Execution via traversal in expressions via string formatter.
Fixes released in Zope 4.6.2, which takes over the already stricter code from Zope 5.2.1.
Remote Code Execution via Python Script.
Fixes released in Zope 4.6.3 and 5.3.



Installation
Installation instructions can be found at
https://plone.org/security/hotfix/20210518

Note
You may get an error when running buildout:
Error: Couldn't find a distribution for 'Products.PloneHotfix20210518==1.0'.
The most likely cause is that you use a too old Python or too old setuptools without “SNI” support.
See this community.plone.org post.
Another cause could be that your buildout is trying to download the hotfix via http or from an older PyPI index.
In the buildout section of your buildout, make sure you use the correct index:
[buildout]
index = https://pypi.org/simple/



Q&A

Q: How can I confirm that the hotfix is installed correctly and my site is protected?
A: On startup, the hotfix will log a number of messages to the Zope event log
that look like this:
2021-05-18 14:07:24,176 INFO [Products.PloneHotfix20210518:43][MainThread] Applied expressions patch
2021-05-18 14:07:24,179 INFO [Products.PloneHotfix20210518:43][MainThread] Applied genericsetup patch
2021-05-18 14:07:24,181 INFO [Products.PloneHotfix20210518:43][MainThread] Applied pas patch
2021-05-18 14:07:24,182 INFO [Products.PloneHotfix20210518:43][MainThread] Applied propertymanager patch
2021-05-18 14:07:24,183 INFO [Products.PloneHotfix20210518:43][MainThread] Applied skinnable patch
2021-05-18 14:07:24,187 INFO [Products.PloneHotfix20210518:43][MainThread] Applied xmlrpc_dump_instance patch
2021-05-18 14:07:24,188 INFO [Products.PloneHotfix20210518:43][MainThread] Applied difftool patch
2021-05-18 14:07:24,238 INFO [Products.PloneHotfix20210518:43][MainThread] Applied event patch
2021-05-18 14:07:24,244 INFO [Products.PloneHotfix20210518:43][MainThread] Applied modeleditor patch
2021-05-18 14:07:24,246 INFO [Products.PloneHotfix20210518:43][MainThread] Applied namedfile patch
2021-05-18 14:07:24,283 INFO [Products.PloneHotfix20210518:43][MainThread] Applied pa_users patch
2021-05-18 14:07:24,367 INFO [Products.PloneHotfix20210518:43][MainThread] Applied portlets patch
2021-05-18 14:07:24,369 INFO [Products.PloneHotfix20210518:43][MainThread] Applied publishing patch
2021-05-18 14:07:24,371 INFO [Products.PloneHotfix20210518:43][MainThread] Applied qi patch
2021-05-18 14:07:24,372 INFO [Products.PloneHotfix20210518:43][MainThread] Applied supermodel patch
2021-05-18 14:07:24,500 INFO [Products.PloneHotfix20210518:43][MainThread] Applied theming patch
2021-05-18 14:07:24,634 INFO [Products.PloneHotfix20210518:43][MainThread] Applied transforms patch
2021-05-18 14:07:24,634 INFO [Products.PloneHotfix20210518:51][MainThread] Hotfix installed
The exact number of patches applied, will differ depending on what packages you are using.
If a patch is attempted but fails, it will be logged as an error that says
“Could not apply”. This may indicate that you have a non-standard Plone
installation. Please investigate, and mail us the accompanying traceback if you think it is a problem in the hotfix.

Q: How can I report problems installing the patch?
A: Contact the Plone security team at [email protected] or visit the
Gitter channel at https://gitter.im/plone/public and the forum at https://community.plone.org

Q: How can I report other potential security vulnerabilities?
A: Please email the security team at [email protected] rather than discussing
potential security issues publicly.




Changelog

1.6 (2021-07-31)

Fix Remote Code Execution via Python Script and string Formatter.
This is a variant of earlier vulnerabilities in this hotfix.
Only Plone 5.2 on Python 3 is vulnerable.
Alternatively on Python 5.2, you can upgrade to AccessControl 4.3.
On earlier versions of Plone and Python, the fix is not needed,
but it is fine to upgrade to this new hotfix version.



1.5 (2021-06-28)

Fixed new XSS vulnerability in folder contents on Plone 5.0 and higher.
Added support for environment variable STRICT_TRAVERSE_CHECK.

Default value is 0, which means as strict as the code from version 1.4.
Value 1 is very strict, the same as the stricter code introduced in Zope 5.2.1
and now taken over in Zope 4.6.2.
There are known issues in Plone with this, for example in the versions history view.
Value 2 means: try to be strict, but if this fails we show a warning and return the found object anyway.
The idea would be to use this in development or production for a while, to see which code needs a fix.


Fix Remote Code Execution via traversal in expressions via string formatter.
This is a variant of two earlier vulnerabilities in this hotfix.



1.4 (2021-06-08)

Use safe html transform instead of escape for richtext diff.
Otherwise the inline diff is not inline anymore.
With PLONEHOTFIX20210518_NAMEDFILE_USE_DENYLIST=1 in the OS environment,
use a denylist for determining which mimetypes can be displayed inline.
By default we use an allowlist with the most used image types, plain text, and PDF.
The denylist contains svg, javascript, and html,
which have known cross site scripting possibilities.
By popular request, allow showing PDF files inline.
Note: browser preference plays a part in what actually happens.
In untrusted path expressions with modules, check that each module is allowed.
In the first version of the hotfix we disallowed modules that were available
as a ‘private’ alias, for example random._itertools.
But if random.itertools without underscore would have been available,
it was still allowed, even though itertools has not been explicitly allowed.
(itertools might be fine to allow, it is just an example.)
This version is a recommended upgrade for all users.



1.3 (2021-06-01)

Moved CHANGES.rst to main directory and add a version.txt there.
This makes it easier to check that you have the correct version when you use the zip download
from https://plone.org/security/hotfix/20210518.
This file is cached, so you might get an earlier version.
Check the sha1 or md5 checksum to be sure.
Define a set ALLOWED_UNDERSCORE_NAMES with allowed names.
This currently contains __name__, _ and _authenticator.
This makes it easier for projects to add a name in a patch if this is really needed.
Be sure you know what you are doing if you override this.
Allow accessing a single underscore _.
After the merge of the hotfix, Zope allows this to fix a test failure.
Seems wise to allow it in the hotfix too.
Allow accessing _authenticator from plone.protect in more cases.
The previous version did this for a traverse class, and now also for a traverse function.



1.2 (2021-05-19)

Allow accessing _authenticator from plone.protect.
It fixes a NotFound error when submitting a PloneFormGen form,
see issue 229.
Should solve similar cases as well.
Fixed the expressions patch.
It unintentionally changed the behavior of the TrustedBoboAwareZopeTraverse class as well.
Most importantly, it let this class use restrictedTraverse, so it did unwanted security checks:
this class is used for expressions in trusted templates on the file system.
Needed for all Plone versions, except 4.3 when it does not have the optional five.pt package.
One test is: login as Editor and go to the @@historyview of a page.
If you get an Unauthorized error, you should upgrade to the new version.
If you are unsure: install this version.



1.1 (2021-05-18)

Allow using __name__ in untrusted expressions.
The previous expressions patch was too strict.
This may be needed in case you have templates that use __name__.
This does not happen often, but one example is the caching-controlpanel view,
which with the previous version may give a 404 NotFound error.
In some Plone versions browser views are affected (Plone 4.3 with five.pt, 5.0, 5.1, 5.2.0-5.2.2).
In all Plone versions skin or through-the-web templates are affected.
When you see more NotFound errors than normal, you should install this new version.
If you are unsure: install this version.



1.0 (2021-05-18)

Initial release