Executive brief
Zope AccessControl is a security component used to restrict what Python code can do within Zope web applications. A vulnerability was found where an attacker with administrative 'Manager' privileges could bypass these restrictions by using specific Python formatting tools to access unauthorized system libraries. This could allow the attacker to execute arbitrary code on the server, potentially leading to a full system takeover, though it requires high-level access to exploit.
Technical details
The AccessControl module in Zope fails to properly sandbox restricted Python code when running on Python 3. While it restricts most modules, it permits the 'string' module, which includes the 'Formatter' class. An attacker can override and extend this class within a 'Script (Python)' object to break out of the restricted environment and access unsafe Python libraries. This vulnerability specifically affects environments running Python 3 (Python 2.7 is unaffected). Exploitation requires the 'Manager' role to add or edit scripts through the web interface. The issue is addressed in AccessControl versions 4.3 and 5.2.
Affected products
- Zope Foundation AccessControl >= 4.0, < 4.3; >= 5.0, < 5.2
- Zope Foundation Zope >= 4.0, < 4.3; >= 5.0, < 5.2
Timeline
- 2021-07-30: disclosed
- 2021-07-30: patched
- 2021-08-05: advisory
References
- https://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf
- https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2c
- https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst
- https://github.com/zopefoundation/Zope/security/advisories/GHSA-g4gq-j4p2-j8fr
- https://github.com/zopefoundation/AccessControl/commit/ae2dab0cc34e6dd1561c5b12d4a56cd140f87e1d