PT-2023-6514 · Unknown · Plone.Rest

Fred Van Dijk · Published 2023-09-21 · Updated 2023-09-25 · CVE-2023-42457

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions plone.rest versions 2.0.0 through 2.0.1 plone.rest versions 3.0.0 through 3.0.1

Description The issue is related to the ++api++ traverser in plone.rest, which allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. When the ++api++ traverser is accidentally used multiple times in a URL, handling it takes increasingly longer, making the server less responsive. This can be exploited to cause a denial of service.

Recommendations For plone.rest versions 2.0.0 through 2.0.1, update to version 2.0.1 to resolve the issue. For plone.rest versions 3.0.0 through 3.0.1, update to version 3.0.1 to resolve the issue. As a temporary workaround, consider redirecting /++api++/++api++ to /++api++ in your frontend web server (nginx, Apache) to minimize the risk of exploitation.

Exploit

Fix

Resource Exhaustion

Allocation of Resources Without Limits

Weakness Enumeration

CWE-400

CWE-770

Related Identifiers

BDU:2023-07261

CVE-2023-42457

GHSA-H6RP-MPRM-XGCQ

PYSEC-2023-178

Affected Products

Plone.Rest

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/42xxx/CVE-2023-42457.json · Exploit
• https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7 · Patch
• https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302 · Patch
• https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-42457 · Security Note
• https://osv.dev/vulnerability/CVE-2023-42457 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h6rp-mprm-xgcq · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-07261 · Security Note
• https://osv.dev/vulnerability/PYSEC-2023-178 · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/plone-rest/PYSEC-2023-178.yaml · Note
• https://github.com/plone/plone.rest · Note
• https://twitter.com/CVEnew/status/1704876935312994716 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1704904548517609601 · Twitter Post
• https://t.me/cvenotify/58313 · Telegram Post
• http://openwall.com/lists/oss-security/2023/09/22/2 · Note