20210518

CVE numbers: See the individual pages of the vulnerabilities.

Versions Affected: All supported Plone versions (4.3.20 and any earlier 4.3.x version, 5.2.4 and any earlier 5.x version).

Versions Not Affected: None.

Zope: Zope is also affected. See details below.

Nature of vulnerabilities:

The patch will address several security issues:

• Remote Code Execution via traversal in expressions via aliases. Reported by David Miller.
• Remote Code Execution via traversal in expressions. Reported by Calum Hutton.
• Remote Code Execution via traversal in expressions via string formatter. Reported by David Miller.
• Writing arbitrary files via docutils and Python Script. Reported by Calum Hutton.
• Various information disclosures: mostly installation logs. Reported by Calum Hutton.
• Stored XSS from file upload (svg, html). Reported separately by Emir Cüneyt Akkutlu and Tino Kautschke.
• Reflected XSS in various spots. Reported by Calum Hutton.
• XSS vulnerability in CMFDiffTool. Reported by Igor Margitich.
• Stored XSS from user fullname. Reported by Tino Kautschke.
• Blind SSRF via feedparser accessing an internal URL. Reported by Subodh Kumar Shree.
• Server Side Request Forgery via event ical URL. Reported by MisakiKata and David Miller.
• Server Side Request Forgery via lxml parser. Reported by MisakiKata and David Miller.
• XSS in folder contents on Plone 5.0 and higher. Reported by Matt Moreschi. Only included since version 1.5 of the hotfix.
• Remote Code Execution via Python Scripts. Reported by Calum Hutton. Only Plone 5.2 on Python 3 is vulnerable. Only included since version 1.6 of the hotfix.

Thank you to all who contacted the Plone security team to report problems!

Version support: The hotfix is officially supported by the Plone security team on the following versions of Plone in accordance with the Plone version support policy: 4.3.20, 5.0.10, 5.1.7, 5.2.4. Previous versions, like 4.2, could be affected but have not been tested. On such old versions, the hotfix might have worse side effects than what it tries to fix.

The fixes included here will be incorporated into subsequent releases of Plone, so Plone 5.2.5 and greater should not require this hotfix. 

Warning: The hotfix has not been tested with Python 2.6. Originally Plone 4.3 was supported on Python 2.6, but since a few releases this is no longer the case since. It gets ever more difficult to test on Python 2.6. By now, you may have trouble installing any package with Python 2.6.

Zope support:

Zope is also affected. New versions for Zope and other packages are available. Upgrading to those is the recommended way.

If you cannot upgrade yet, you can try the Plone hotfix. It has not been tested on Zope only, but we try not to let the Plone-specific code get in the way, so it should be okay.

These vulnerabilities mentioned above are relevant for Zope:

• Remote Code Execution via traversal in expressions via aliases.
  Fixes released in Zope 4.6 and 5.2.
• Remote Code Execution via traversal in expressions (no aliases).
  Fixes released in Zope 4.6.1 and 5.2.1.
• Various information disclosures.
  Fixes released in Products.PluggableAuthService 2.6.0, Products.GenericSetup 2.1.1, and Zope 4.5.5.
• Reflected XSS in various spots.
  Fixes released in Products.CMFCore 2.5.1 and Products.PluggableAuthService 2.6.2.
• Remote Code Execution via Python Scripts.
  Fixes released in AccessControl 4.3 (Zope 4.6.3) and 5.2 (Zope 5.3).

Installation instructions

The procedure for installing Hotfix 20210518 differs slightly based on which version of Plone or Zope you are running, and whether you installed Plone or Zope using buildout.

Backup First!

It is prudent to backup all your data and installation files before installing any Plone add-on, including this hotfix.  If you already have a solid Plone backup routine in place, then you can skip this step and proceed.

If you don't already have a backup of your Plone site, the simplest way to back up your Plone instance is to simply copy your entire Zope instance folder or buildout folder to a secure location.

Recommended Install Procedure Plone 5.1 and earlier

If you're less experienced with Plone, the easiest way to install Hotfix 20210518 on Plone 4.3 - Plone 5.1 (not 5.2) is as follows:

1) Download the hotfix archive using the link above.  If you have an md5 tool available (Linux or Mac), use it to check that the signature matches.

2) Place the downloaded zip file into the "products" directory in your Zope instance. On pre-buildout installations, this will be "Products".

3) Unpack the zip file.

On Linux or Mac, the command is:

 $ unzip PloneHotfix20210518-1.6.zip

On Windows, use your favorite archiving product. (7Zip is a good choice).

4)  Restart your Zope instance in foreground mode to ensure that the hotfix is installed.

On Mac or Linux, the command is typically:

 $ bin/instance fg

On Windows, the command is typically:

> bin\instance.exe fg

Zope will start in the foreground, and you should see the message "INFO PloneHotfix20210518 Hotfix installed." during startup.

5) Stop the foreground instance of Zope by hitting CTRL-C

6) Restart your Zope instance.

On Mac or Linux, the command is typically:

$ bin/instance start

On Windows, the command is typically:

> bin\instance.exe start

If you're using ZEO clients, change instance to client1, client2, etc., in the above commands.

Recommended Install Procedure Plone 5.2 or installing with Buildout

If you are an experienced Plone administrator, and you are using a buildout-based installation of Plone, you may choose to install Hotfix 20210518 with buildout. For Plone 5.2 this is the only option, because there is no products directory anymore. However, if you choose to do this, you must be certain that you will not accidentally overwrite Plone components with newer versions.  This is particularly likely if you try to use buildout with older versions of Plone.

If you are not sure what you're doing, please use the "Recommended Installation Instructions" above if possible.

You may get an error when running buildout:

Error: Couldn't find a distribution for 'Products.PloneHotfix20210518==1.6'.

The most likely cause is that you use a too old Python or too old setuptools without "SNI" support.
See this community.plone.org post. Make sure you use setuptools 36.8.0 or higher. Best is to not increase the version more than needed, to avoid a possible incompatibility with plone.recipe.zope2instance.

Another cause could be that your buildout is trying to download the hotfix via http or from an older PyPI index, especially when your zc.buildout version is old.
In the buildout section of your buildout, make sure you use the correct index:

[buildout]
index = https://pypi.org/simple/

1) Find your buildout.cfg file, typically located in the "zinstance" subdirectory of your Plone installation directory. (If you're using ZEO clients, the subdirectory may be called "zeoserver").

2) Open your buildout.cfg file in your text editor. 

3) Scroll down to the "eggs" section of the buildout and add Products.PloneHotfix20210518, e.g.

[buildout]
...
eggs = 
    Products.PloneHotfix20210518

[versions]
Products.PloneHotfix20210518 = 1.6

4) Rerun buildout.

On Mac or Linux, the command is:

$ ./bin/buildout -Nv

On windows, the command is:

> bin\buildout.exe -Nv

5) Restart your Zope instance.

On Mac or Linux, the command is:

$ ./bin/instance start

On Windows, the command is:

> bin\instance.exe start

Alternatively, on Windows, you may restart the Zope service via the Windows Services control panel.

If you're using ZEO clients, change instance to client1, client2, etc., in the above commands.

Confirming Installation

On startup, the hotfix will log a number of messages to the Zope event log. You can use this to confirm the patch is successfully installed. They look like this:

2021-05-18 14:07:24,176 INFO [Products.PloneHotfix20210518:43][MainThread] Applied expressions patch
2021-05-18 14:07:24,179 INFO [Products.PloneHotfix20210518:43][MainThread] Applied genericsetup patch
2021-05-18 14:07:24,181 INFO [Products.PloneHotfix20210518:43][MainThread] Applied pas patch
2021-05-18 14:07:24,182 INFO [Products.PloneHotfix20210518:43][MainThread] Applied propertymanager patch
2021-05-18 14:07:24,183 INFO [Products.PloneHotfix20210518:43][MainThread] Applied skinnable patch
2021-05-18 14:07:24,187 INFO [Products.PloneHotfix20210518:43][MainThread] Applied xmlrpc_dump_instance patch
2021-05-18 14:07:24,188 INFO [Products.PloneHotfix20210518:43][MainThread] Applied difftool patch
2021-05-18 14:07:24,238 INFO [Products.PloneHotfix20210518:43][MainThread] Applied event patch
2021-05-18 14:07:24,244 INFO [Products.PloneHotfix20210518:43][MainThread] Applied modeleditor patch
2021-05-18 14:07:24,246 INFO [Products.PloneHotfix20210518:43][MainThread] Applied namedfile patch
2021-05-18 14:07:24,283 INFO [Products.PloneHotfix20210518:43][MainThread] Applied pa_users patch
2021-05-18 14:07:24,367 INFO [Products.PloneHotfix20210518:43][MainThread] Applied portlets patch
2021-05-18 14:07:24,369 INFO [Products.PloneHotfix20210518:43][MainThread] Applied publishing patch
2021-05-18 14:07:24,371 INFO [Products.PloneHotfix20210518:43][MainThread] Applied qi patch
2021-05-18 14:07:24,372 INFO [Products.PloneHotfix20210518:43][MainThread] Applied supermodel patch
2021-05-18 14:07:24,500 INFO [Products.PloneHotfix20210518:43][MainThread] Applied theming patch
2021-05-18 14:07:24,634 INFO [Products.PloneHotfix20210518:43][MainThread] Applied transforms patch
2021-05-18 14:07:24,634 INFO [Products.PloneHotfix20210518:51][MainThread] Hotfix installed

Not all patches are needed in all Plone versions, and may depend on which extra packages you have installed. Patches that are not relevant for you, do not appear in the log.

If the hotfix tries to apply a patch and there is an error, then you may have a setup that we did not consider. Please investigate then. You will get an error like this, followed by a traceback:

2021-05-18 14:12:40,856 ERROR   [Products.PloneHotfix20210518:47][MainThread] Could not apply difftool