Zope AccessControl up to 4.3/5.7/6.1 information disclosure

Summaryinfo

A vulnerability described as problematic has been identified in Zope AccessControl up to 4.3/5.7/6.1. The impacted element is an unknown function. Such manipulation leads to information disclosure. This vulnerability is listed as CVE-2023-41050. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability was found in Zope AccessControl up to 4.3/5.7/6.1 (Application Server Software). It has been rated as problematic. Affected by this issue is an unknown code block. The manipulation with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. CVE summarizes:

AccessControl provides a general security framework for use in Zope. Python's "format" functionality allows someone controlling the format string to "read" objects accessible (recursively) via attribute access and subscription from accessible objects. Those attribute accesses and subscriptions use Python's full blown `getattr` and `getitem`, not the policy restricted `AccessControl` variants `_getattr_` and `_getitem_`. This can lead to critical information disclosure. `AccessControl` already provides a safe variant for `str.format` and denies access to `string.Formatter`. However, `str.format_map` is still unsafe. Affected are all users who allow untrusted users to create `AccessControl` controlled Python code and execute it. A fix has been introduced in versions 4.4, 5.8 and 6.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The weakness was presented 09/07/2023 as GHSA-8xv7-89vj-q48c. The advisory is shared for download at github.com. This vulnerability is handled as CVE-2023-41050 since 08/22/2023. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1592.

Upgrading to version 4.4, 5.8 or 6.2 eliminates this vulnerability. Applying the patch 6bc32692e0d4b8d5cf64eae3d19de987c7375bc9 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Application Server Software

Vendor

• Zope

Name

• AccessControl

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5
• 5.6
• 5.7
• 6.0
• 6.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion