CVE-2021-32807: Zope AccessControl remote code execution via Formatter class in Python 3

CVE-2021-32807 · Severity: medium · CVSS 4.4 · Published 2021-08-05

Zope AccessControl is a security component used to restrict what Python code can do within Zope web applications. A vulnerability was found where an attacker with administrative 'Manager' privileges could bypass these restrictions by using specific Python formatting tools to access unauthorized system libraries. This could allow the attacker to execute arbitrary code on the server, potentially leading to a full system takeover, though it requires high-level access to exploit.

Technologies: AccessControl (PyPI), Zope (PyPI). Vendors: PyPI.

Quick answers

Is CVE-2021-32807 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2021-32807 being exploited in the wild.
How severe is CVE-2021-32807?
Medium severity, with a CVSS score of 4.4, published 5 August 2021.
Which products and versions are affected?
AccessControl (PyPI) ECOSYSTEM:introduced=4.0,fixed=4.3, GIT:introduced=0,fixed=b42dd4badf803bb9fb71ac34cd9cb0c249262f2c|ECOSYSTEM:introduced=4.0,fixed=4.3,introduced=5.0,fixed=5.2; Zope (PyPI) ECOSYSTEM:introduced=4.0,fixed=4.3, GIT:introduced=0,fixed=b42dd4badf803bb9fb71ac34cd9cb0c249262f2c|ECOSYSTEM:introduced=4.0,fixed=4.3,introduced=5.0,fixed=5.2.
Is there a fix for CVE-2021-32807?
Yes. AccessControl (PyPI): upgrade to 4.3, 5.2 or later; Zope (PyPI): upgrade to 4.3, 5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-32807 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2021-32807?
Check whether you run AccessControl (PyPI) or Zope (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • AccessControl (PyPI): upgrade to 4.3, 5.2 or later
    pip install "AccessControl>=5.2"
  • Zope (PyPI): upgrade to 4.3, 5.2 or later
    pip install "Zope>=5.2"

Technical details

The AccessControl module in Zope fails to properly sandbox restricted Python code when running on Python 3. While it restricts most modules, it permits the 'string' module, which includes the 'Formatter' class. An attacker can override and extend this class within a 'Script (Python)' object to break out of the restricted environment and access unsafe Python libraries. This vulnerability specifically affects environments running Python 3 (Python 2.7 is unaffected). Exploitation requires the 'Manager' role to add or edit scripts through the web interface. The issue is addressed in AccessControl versions 4.3 and 5.2.

Affected products

  • Zope Foundation AccessControl >= 4.0, < 4.3; >= 5.0, < 5.2
  • Zope Foundation Zope >= 4.0, < 4.3; >= 5.0, < 5.2

Identifiers

  • CVE-2021-32807
  • GHSA-qcx9-j53g-ccgf
  • PYSEC-2021-335
  • PYSEC-2021-875

Timeline

  • 2021-07-30: disclosed
  • 2021-07-30: patched
  • 2021-08-05: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.