GHSA-g4c2-ghfg-g5rh Cross-site Scripting and Open Redirect in Products.ATContentTypes

• PyPI Products.ATContentTypes: < 3.0.6 → fixed in 3.0.6

Impact Plone is vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on your cache settings. Patches A new version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2 (Python 2 only) and will be included in Plone 5.2.7. Note that the Products.CMFPlone package has the same problem in the 4.3 series. `plone.app.contenttypes` has the same problem in all versions, see advisory. For all unpatched versions of the three packages, you can use the following workaround. Workaround Make sure the image_view_fullscreen page is not stored in the cache. In Plone: • Login as Manager and go to Site Setup. • Go to the 'Caching' control panel. If this does not exist, or 'Enable caching' is not checked, you should normally not be vulnerable. • Click on the tab 'Caching operations'. • Under 'Legacy template mappings' locate the ruleset 'Content item view'. • From the last column ('Templates') remove 'image_view_fullscreen'. • Click on Save. Reporter This vulnerability was responsibly disclosed to the Plone Security Team by Gustav Hansen, F-Secure Consulting. Thank you! For more information If you have any questions or comments about this advisory, email us at [email protected] This is also the correct address to use when you want to report a possible vulnerability. See our security report policy.