Plone up to 2.5-5.1rc1 Login Form came_from redirect

Summaryinfo

A vulnerability classified as problematic has been found in Plone up to 2.5-5.1rc1. This impacts an unknown function of the component Login Form Handler. Performing a manipulation of the argument came_from as part of Parameter results in redirect. This vulnerability is known as CVE-2017-1000481. Remote exploitation of the attack is possible. No exploit is available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical has been found in Plone up to 2.5-5.1rc1 (Content Management System). This affects some unknown processing of the component Login Form Handler. The manipulation of the argument came_from as part of a Parameter leads to a redirect vulnerability. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

When you visit a page where you need to login, Plone 2.5-5.1rc1 sends you to the login form with a 'came_from' parameter set to the previous url. After you login, you get redirected to the page you tried to view before. An attacker might try to abuse this by letting you click on a specially crafted link. You would login, and get redirected to the site of the attacker, letting you think that you are still on the original Plone site. Or some javascript of the attacker could be executed. Most of these types of attacks are already blocked by Plone, using the `isURLInPortal` check to make sure we only redirect to a page on the same Plone site. But a few more ways of tricking Plone into accepting a malicious link were discovered, and fixed with this hotfix.

The bug was discovered 11/28/2017. The weakness was published 01/03/2018 (Website). The advisory is shared at plone.org. This vulnerability is uniquely identified as CVE-2017-1000481 since 01/03/2018. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. It demands that the victim is doing some kind of user interaction. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1204.001 for this issue.

The vulnerability was handled as a non-public zero-day exploit for at least 36 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 2.5-5.1rc1 eliminates this vulnerability.

Similar entries are available at VDB-111288, VDB-111287 and VDB-111286. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Content Management System

Name

• Plone

Version

• 2.5-5.1rc1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion