CVE-2021-3313

Vulnerability

Plone CMS versions up to and including 5.2.2 and 5.2.1 (and possibly earlier) contain a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. User input data is not properly encoded when echoed back in the browser, allowing executable code to be interpreted by the browser if a victim visits a vulnerable page. The vulnerability is present in Plone 5.2.2 (5209) and 5.2.1 (5208); versions 5.2.3 and 5.2.4 were not tested in the advisory but the hotfix released on 2021-05-18 mitigates the issue [1][2].

Exploitation

An authenticated attacker (e.g., a user who can edit their own profile or upload files) can inject malicious JavaScript payloads into the fullname field or file upload metadata. When a privileged user (e.g., an administrator) views the attacker's profile or a page containing the uploaded file, the payload executes in the context of the victim's browser. The attack is remote, requires prior authentication, and can be performed with three requests in the privilege escalation scenario described in the advisory [2].

Impact

Successful exploitation enables the attacker to steal the session cookie of a higher-privileged user, leading to privilege escalation. The attacker can then deploy Plone PythonScripts, steal or manipulate user data, and redirect victims to phishing pages. The overall impact includes confidentiality loss (data theft), integrity loss (manipulation), and potential complete takeover of the targeted CMS instance [2].

Mitigation

Plone released a security hotfix on 2021-05-18 (hotfix 20210518). The fix is incorporated in Plone versions 5.2.4 (with the hotfix) and 5.2.5, and later versions. Users should upgrade to a patched version or apply the hotfix as described in the Plone security advisory [2][4]. No workaround other than the official patch is documented in the available references.