GHSA-hc5c-r8m5-2gfh: Plone.restapi Plone.restapi Vulnerable To Stored Cross Vulnerability

LOW
Share
CVSS 3.7
CWE-80 CWE-79
Published
Advisory Summary

GHSA-hc5c-r8m5-2gfh is a LOW (CVSS 3.7) plone.restapi vulnerable to stored cross vulnerability (CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)) affecting Plone.restapi libraries in the PyPI ecosystem. The issue involves plone.restapi vulnerable to stored cross site scripting with svg image in user portrait. Remediation is available by upgrading affected packages to version 8.43.3.

GHSA-hc5c-r8m5-2gfh at a Glance

CVE Identifier N/A
GHSA Identifier GHSA-hc5c-r8m5-2gfh
Severity LOW
CVSS v3.1 Base Score 3.7
CWE Classification CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Affected Product Plone.restapi
Package Ecosystem PyPI
Published Date
Last Updated

Security Impact

CVSS: 3.7

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N).

Attack Vector Network (AV:N)
Attack Complexity High (AC:H)
Privileges Required Low (PR:L)
User Interaction Required (UI:R)
Scope Unchanged (S:U)
Confidentiality Low (C:L)
Integrity Low (I:L)
Availability None (A:N)

How to Fix GHSA-hc5c-r8m5-2gfh

To remediate this vulnerability, upgrade all affected Plone.restapi dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

plone.restapi fixed: 8.43.3 
pip install plone.restapi>=8.43.3
Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

pip show plone.restapi

How to Check if You Are Affected

To determine whether your Python environment is affected by GHSA-hc5c-r8m5-2gfh, inspect your installed packages using pip:

pip show plone.restapi

Analyze the terminal output to locate any version of Plone.restapi in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 8.43.3), your application is affected.

Note: The pip show plone.restapi command checks currently installed packages in your active Python environment.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS), where the product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages. In Plone.restapi, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact There is a stored cross site scripting vulnerability for SVG images uploaded in user portraits. Note that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait. ### Patches A patch will be released in `plone.restapi` 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3. In `plone.restapi` 7 or earlier there was no `@portrait` endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a [fix in Zope 4](https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v). These two vulnerabilities share the same CVE: CVE-2023-42458. ### Workarounds You could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.

GHSA-hc5c-r8m5-2gfh Affected Plone.restapi Versions

1 component(s)
Fixed Versions:
8.43.3
Product / Package Ecosystem Affected Versions Fixed Version
plone.restapi
pypi/plone.restapi
PyPI
≥ 8.0.0
< 8.43.3
8.43.3

References

GitHub Advisory / Wiki ADVISORY
https://github.com/plone/plone.restapi/security/advisories/GHSA-hc5c-r8m5-2gfh
GitHub Advisory / Wiki ADVISORY
https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v
Security Fix Commit FIX COMMIT
https://github.com/plone/plone.restapi/commit/5f44c23ac69db7d6d933d77f177e07603cf05f8b
Plone.restapi Source Repository REPOSITORY
https://github.com/plone/plone.restapi

Frequently Asked Questions

What is GHSA-hc5c-r8m5-2gfh?
GHSA-hc5c-r8m5-2gfh is a security vulnerability in Plone.restapi involving plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS).
Which Plone.restapi versions are affected?
Affected versions include releases prior to 8.43.3 across affected packages: plone.restapi.
What version fixes GHSA-hc5c-r8m5-2gfh?
Upgrading to 8.43.3 (or the latest patched release for your respective branch) resolves the vulnerability.
Is plone.restapi affected?
Yes, plone.restapi is affected in releases prior to 8.43.3. Upgrade your dependency to 8.43.3 or later.
What is the CVSS score of GHSA-hc5c-r8m5-2gfh?
GHSA-hc5c-r8m5-2gfh has a CVSS v3.1 base score of 3.7 (LOW) with vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N.
What CWE is associated with GHSA-hc5c-r8m5-2gfh?
GHSA-hc5c-r8m5-2gfh is classified under CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) (The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.).
How can I check PyPI dependencies for GHSA-hc5c-r8m5-2gfh?
Run the dependency tree command: 'pip show plone.restapi'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-hc5c-r8m5-2gfh",
  "modified" : "2023-09-21T17:16:44Z",
  "published" : "2023-09-21T17:16:44Z",
  "aliases" : [ ],
  "summary" : "plone.restapi vulnerable to Stored Cross Site Scripting with SVG image in user portrait",
  "details" : "### Impact\nThere is a stored cross site scripting vulnerability for SVG images uploaded in user portraits.\n\nNote that a page that uses an image tag with an SVG image as source is never vulnerable, even when the SVG image contains malicious code. To exploit the vulnerability, an attacker would first need to upload an SVG image as user portrait, and then trick a user into following a link to this portrait.\n\n### Patches\nA patch will be released in `plone.restapi` 8.43.3. This version is good for Plone 6.0, and for Plone 5.2 on Python 3.\n\nIn `plone.restapi` 7 or earlier there was no `@portrait` endpoint yet, so there is nothing to fix in that version. It is still vulnerable to this attack, and needs a [fix in Zope 4](https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v). These two vulnerabilities share the same CVE: CVE-2023-42458.\n\n### Workarounds\nYou could remove the portrait field from the member data schema, and possibly remove all portraits that are already in the database, but this seems a bit drastic.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "PyPI",
      "name" : "plone.restapi"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "8.0.0"
      }, {
        "fixed" : "8.43.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.restapi/security/advisories/GHSA-hc5c-r8m5-2gfh"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/zopefoundation/Zope/security/advisories/GHSA-wm8q-9975-xh5v"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/plone/plone.restapi/commit/5f44c23ac69db7d6d933d77f177e07603cf05f8b"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/plone/plone.restapi"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-79", "CWE-80" ],
    "severity" : "LOW",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-09-21T17:16:44Z",
    "nvd_published_at" : null
  }
}