Historic Plone Security Vulnerability
February 3, 2011 Leave a Comment
I spent a lot of time researching the right CMS to choose as our enterprise CMS before deciding on Plone. What really impressed about Plone was its security record. It was dang near perfect. Today was a bit of a surprise for me but again, the folks at the Plone Foundation came through with a great work around and a soon to be released patch.
This is an escalation of privileges attack that can be used by anonymous users to gain access to a Plone site’s administration controls, view unpublished content, create new content and modify a site’s skin. The sandbox protecting access to the underlying system is still in place, and it does not grant access to other applications running on the same Zope instance.
All versions of Plone since 2.5 are affected, viz. 2.5, 3.0, 3.1, 3.2, 3.3, 4.0; including all minor and development revisions of these versions.
Due to the severity of this issue Plone is providing an advance warning of an upcoming patch, which will be released on this page at 1600 GMT on Tuesday 8th February 2011.
Workaround
Due to the nature of the vulnerability, the security team has decided to pre-announce that a fix is upcoming before disclosing the details, to ensure that concerned users can plan around the release. As the fix being published will make the details of the vulnerability public the Plone Foundation is recommending that all users plan a maintenance window for 30 minutes either side of the announcement where your site is completely inaccessible in which to install the fix.
If you cannot have this time offline they STRONGLY recommend that you take one of the following steps to protect your site from before the announcement until you apply the fix:
- Make your database read-only.
- Alternatively, if this option isn’t possible due to not using one of the standard ZODB backends, disable logins by filtering HTTP authentication and cookies in Apache or Varnish.
These do not need to be in place for the entire week but should already be in place before the fix and vulnerability details are released next week. By preventing modifications to your site and patching your site quickly you remove the incentive for potential attackers to attempt this attack.
About Jason
