| Package | Affected versions | Patched versions |
|---|---|---|
| products-isurlinportal | ≥ 3.0.0, < 3.1.0≥ 4.0.0a1, < 4.0.0< 2.1.0 | 3.1.04.0.02.1.0 |
| isurlinportal | = 4.0.0≥ 3.0.0, < 3.1.0< 2.1.0 | 3.1.02.1.0 |
A url /login?came_from=////evil.example may redirect to an external website after login.
Standard Plone is not affected, but if you have customised the login, for example with add-ons, you might be affected. You can try the url to check if you are affected or not.
The problem has been patched in Products.isurlinportal.
Products.isurlinportal 4.0.0.Products.isurlinportal 3.1.0.Products.isurlinportal 2.1.0.There are no known workarounds.
When you are anonymous and land on a page that requires a login, Plone sends you to the login form. After successful login, Plone redirects you back to the page you came from. Various other forms and pages have a similar system.
This could get abused by an attacker to trick Plone into redirecting to a different website. Plone checks the page that would be redirected to. It is only accepted if it is within the Plone site domain or part of a different trusted domain.
The main check for this is in the Products.isurlinportal package. A lot of potentially malicious urls are already safely rejected, but here a loop hole was found.
This was discovered during a penetration test by the CERT-EU Team.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free