Junglewise Threat Intelligence

CVE-2021-32674: Zope RCE via traversal in TAL expressions

CVE-2021-32674 · Severity: high · CVSS 8.8 · Published 2021-06-08

Technologies: Zopefoundation Zope. Vendors: PyPI.

Executive brief

Zope is an open-source web application server. A vulnerability in its page templating system allows users with certain permissions to bypass security restrictions and execute arbitrary code on the server. This could lead to a complete system takeover, data theft, or service disruption, particularly in environments where untrusted users are granted template editing privileges.

Technical details

A Remote Code Execution (RCE) vulnerability exists in Zope due to improper path traversal limitations in Template Attribute Language (TAL) expressions. While Zope normally restricts access to sensitive Python modules like 'os' within templates, an attacker can bypass these restrictions by traversing through indirectly available modules. This allows an authenticated user with the ability to add or edit Zope Page Templates (typically requiring the 'Manager' role) to execute arbitrary Python code. The vulnerability is a continuation of a previous flaw (CVE-2021-32633) and has been addressed in Zope versions 4.6.1 and 5.2.1. Exploitation requires network access to the Zope management interface and valid credentials with template editing permissions.

Affected products

  • zopefoundation Zope < 4.6.1, >= 5.0, < 5.2.1

Timeline

  • 2021-05-21: other: Initial related vulnerability (GHSA-5pr9-v234-jw36) disclosed
  • 2021-06-08: advisory: GHSA-rpcg-f9q6-2mq6 published
  • 2021-06-08: patched: Fixes released in Zope 4.6.1 and 5.2.1

References

Related threats