CVE-2023-36814

Unauthenticated DoS in Products.CMFCore

• CVSS 7.5
• CWE-770
• Input Validation and Sanitization
• Remote

Products.CMFCore are the key framework services for the Zope Content Management Framework (CMF). The use of Python's marshal module to handle unchecked input in a public method on `PortalFolder` objects can lead to an unauthenticated denial of service and crash situation. The code in question is exposed by all portal software built on top of `Products.CMFCore`, such as Plone. All deployments are vulnerable. The code has been fixed in `Products.CMFCore` version 3.2.

CVE

CVE-2023-36814

CWE

CWE-770

CVSS base score

7.5

Published

2023-07-03

OWASP

A06 Vulnerable and Outdated Components

Orthogonal defect classification

Algorithm

Code defect classification

Incorrect Algorithm

Category

Input Validation and Sanitization

Subcategory

Insecure Parsing or Deserialization

Accessibility scope

Remote

Impact

Denial of Service (DoS)

Fixed by upgrading

Yes

Solution

Update to `Products.CMFCore` version 3.2 or higher

from Products.CMFCore.PortalFolder import PortalFolder
import marshal

class ModifiedPortalFolder(PortalFolder):
    def load_data(self, data):
        return marshal.loads(data)

from Products.CMFCore.PortalFolder import PortalFolder
import marshal

class ModifiedPortalFolder(PortalFolder):
    def load_data(self, data):
        try:
            if not isinstance(data, bytes):
                raise ValueError("Input data must be bytes.")
            
            return marshal.loads(data)
        except Exception as e:
            raise ValueError("Invalid input data provided.") from e

@misc{vaitp:cve202336814,
  title        = {{Unauthenticated DoS in Products.CMFCore}},
  author       = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
  year         = {2023},
  note         = {VAITP Python Vulnerability Dataset, entry CVE-2023-36814},
  howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2023-36814/}}
}