PT-2021-19944 · Zope · Accesscontrol+1
Dataflake
·
Published
2021-07-30
·
Updated
2022-12-02
·
CVE-2021-32807
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
AccessControl versions 4.0 through 4.2
AccessControl versions 5.0 through 5.1
Zope versions prior to 4.6.3
Zope versions prior to 5.3
Description
The module
AccessControl defines security policies for Python code used in restricted code within Zope applications. The policies defined in AccessControl severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's string module. However, full access to the string module also allows access to the class Formatter, which can be overridden and extended within Script (Python) in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk.Recommendations
For AccessControl versions 4.0 through 4.2, update to version 4.3 or later.
For AccessControl versions 5.0 through 5.1, update to version 5.2 or later.
For Zope versions prior to 4.6.3, update to version 4.6.3 or later.
For Zope versions prior to 5.3, update to version 5.3 or later.
As a temporary workaround, restrict adding/editing
Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only.Fix
Prototype Pollution
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Accesscontrol
Zope