CVE-2016-4043

Chameleon vulnerability in Plone 5.0rc1 – 5.1a1: Authenticated users bypass Restricted Python via template permissions

• CVSS 4.9
• CWE-264
• Authentication, Authorization, and Session Management
• Remote

Chameleon (five.pt) in Plone 5.0rc1 through 5.1a1 allows remote authenticated users to bypass Restricted Python by leveraging permissions to create or edit templates.

CVE

CVE-2016-4043

CWE

CWE-264

CVSS base score

4.9

Published

2017-02-24

OWASP

A01 Broken Access Control

Orthogonal defect classification

Checking

Code defect classification

Incorrect Check

Category

Authentication, Authorization, and Session Management

Subcategory

Privilege Escalation

Accessibility scope

Remote

Impact

Privilege Escalation

Fixed by upgrading

Yes

Solution

Upgrade Plone to version 5.1a2 or higher.

from Products.Five import BrowserView

class TemplateView(BrowserView):
    def __call__(self):
        return self.render_template()

    def render_template(self):
        return self.context.restrictedTraverse('template_view')()

from Products.Five import BrowserView
from AccessControl import getSecurityManager
from AccessControl import Unauthorized

class TemplateView(BrowserView):
    def __call__(self):
        if not getSecurityManager().checkPermission('View', self.context):
            raise Unauthorized("You do not have permission to view this template.")
        
        return self.render_template()

    def render_template(self):
        return self.context.restrictedTraverse('template_view')()

@misc{vaitp:cve20164043,
  title        = {{Chameleon vulnerability in Plone 5.0rc1 - 5.1a1: Authenticated users bypass Restricted Python via template permissions}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2017},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2016-4043},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2016-4043/}}
}