Plone Classic Portlet TALES Expression Code Execution Vulnerability

A code execution vulnerability was found in plone.app.portlets, the Plone portlets package. The Classic portlet used its user-supplied template/macro fields to build a TALES path expression that was then evaluated by the TAL path() helper. Because the value was interpreted as a full TALES expression, a user able to add or edit a Classic portlet could supply a crafted value that escapes simple path traversal and is evaluated as arbitrary code.

This is exploitable by any authenticated user who can configure a Classic portlet. With the default role map, regular users can configure one on their personal dashboard. The result is code execution in the context of the Plone process, i.e. a privilege escalation across the trust boundary between an authenticated web user and the server-side process.

Affected versions and patches:

• Affected: 5.0.0 through before 5.0.8, 6.0.0 through before 6.0.4, and 7.0.0 through before 7.0.2.
• Patched: 5.0.8, 6.0.4, and 7.0.2.

Workarounds:

• Restrict who can manage portlets: remove the plone.app.portlets.ManageOwnPortlets permission from untrusted roles, and limit Manage portlets to trusted administrators.
• Unregister the Classic portlet if it is not needed by editing a portlets.xml in your own code.
• Customize the classic.pt template to disable it, for example by replacing its content with the text 'The classic portlet was disabled.'