Is CVE-2021-32674 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-32674 being exploited in the wild.

How severe is CVE-2021-32674?

High severity, with a CVSS score of 8.8, published 8 June 2021.

Which products and versions are affected?

Zope (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.1, ECOSYSTEM:introduced=5.0,fixed=5.2.1, GIT:introduced=0,fixed=1d897910139e2c0b11984fc9b78c1da1365bec21|ECOSYSTEM:introduced=4.0,fixed=4.6.1,introduced=5.0,fixed=5.2.1.

Is there a fix for CVE-2021-32674?

Yes. Zope (PyPI): upgrade to 4.6.1, 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-32674 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-32674?

Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-32674: Zope RCE via traversal in TAL expressions

CVE-2021-32674 · Severity: high · CVSS 8.8 · Published 2021-06-08

Zope is an open-source web application server. A vulnerability in its page templating system allows users with certain permissions to bypass security restrictions and execute arbitrary code on the server. This could lead to a complete system takeover, data theft, or service disruption, particularly in environments where untrusted users are granted template editing privileges.

Technologies: Zope (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-32674 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-32674 being exploited in the wild.
How severe is CVE-2021-32674?: High severity, with a CVSS score of 8.8, published 8 June 2021.
Which products and versions are affected?: Zope (PyPI) ECOSYSTEM:introduced=0,fixed=4.6.1, ECOSYSTEM:introduced=5.0,fixed=5.2.1, GIT:introduced=0,fixed=1d897910139e2c0b11984fc9b78c1da1365bec21|ECOSYSTEM:introduced=4.0,fixed=4.6.1,introduced=5.0,fixed=5.2.1.
Is there a fix for CVE-2021-32674?: Yes. Zope (PyPI): upgrade to 4.6.1, 5.2.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32674 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-32674?: Check whether you run Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Zope (PyPI): upgrade to 4.6.1, 5.2.1 or later
```
pip install "Zope>=5.2.1"
```

Technical details

A Remote Code Execution (RCE) vulnerability exists in Zope due to improper path traversal limitations in Template Attribute Language (TAL) expressions. While Zope normally restricts access to sensitive Python modules like 'os' within templates, an attacker can bypass these restrictions by traversing through indirectly available modules. This allows an authenticated user with the ability to add or edit Zope Page Templates (typically requiring the 'Manager' role) to execute arbitrary Python code. The vulnerability is a continuation of a previous flaw (CVE-2021-32633) and has been addressed in Zope versions 4.6.1 and 5.2.1. Exploitation requires network access to the Zope management interface and valid credentials with template editing permissions.

Affected products

zopefoundation Zope < 4.6.1, >= 5.0, < 5.2.1

Identifiers

CVE-2021-32674
GHSA-5vq5-pg3r-9ph3
GHSA-rpcg-f9q6-2mq6
PYSEC-2021-104

Timeline

2021-05-21: other: Initial related vulnerability (GHSA-5pr9-v234-jw36) disclosed
2021-06-08: advisory: GHSA-rpcg-f9q6-2mq6 published
2021-06-08: patched: Fixes released in Zope 4.6.1 and 5.2.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.