CVE-2021-32633
Untrusted users access modules in Zope < 4.6 and 5.2
- CVSS 8.8
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- Input Validation and Sanitization
- Remote
Zope is an open-source web application server. In Zope versions prior to 4.6 and 5.2, users can access untrusted modules indirectly through Python modules that are available for direct use. By default, only users with the Manager role can add or edit Zope Page Templates through the web, but sites that allow untrusted users to add/edit Zope Page Templates through the web are at risk from this vulnerability. The problem has been fixed in Zope 5.2 and 4.6. As a workaround, a site administrator can restrict adding/editing Zope Page Templates through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing Zope Page Templates through the web should be restricted to trusted users only.
- CVSS base score
- 8.8
- Published
- 2021-05-21
- OWASP
- A01 Broken Access Control
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Input Validation and Sanitization
- Subcategory
- Insecure Direct Object References (IDOR)
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Update to Zope version 5.2 or 4.6.
Vulnerable code sample
from Products.PageTemplates.PageTemplateFile import PageTemplateFile
class PageTemplate:
def __init__(self):
self.templates = {}
def addPageTemplate(self, template_id, content):
self.templates[template_id] = PageTemplateFile(template_id, content)
def editPageTemplate(self, template_id, new_content):
if template_id in self.templates:
self.templates[template_id].write(new_content)
template = PageTemplate()
template.addPageTemplate('untrusted_template', '<html><body>Hello World</body></html>')
template.editPageTemplate('untrusted_template', '<html><body>Modified Content</body></html>')Patched code sample
import html
from Products.PageTemplates.PageTemplateFile import PageTemplateFile
class PageTemplate:
def __init__(self):
self.templates = {}
def sanitize_content(self, content):
return html.escape(content)
def addPageTemplate(self, template_id, content):
content = self.sanitize_content(content)
self.templates[template_id] = PageTemplateFile(template_id, content)
def editPageTemplate(self, template_id, new_content):
if template_id in self.templates:
content = self.sanitize_content(new_content)
self.templates[template_id].write(content)
template = PageTemplate()
template.addPageTemplate('untrusted_template', '<html><body>Hello World</body></html>')
template.editPageTemplate('untrusted_template', '<html><body>Modified Content</body></html>')Cite this entry
@misc{vaitp:cve202132633,
title = {{Untrusted users access modules in Zope < 4.6 and 5.2}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2021},
note = {VAITP Python Vulnerability Dataset, entry CVE-2021-32633},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2021-32633/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::