CVE-2021-32807
published 2021-07-30CVE-2021-32807: The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides…
PriorityP346high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EPSS
2.03%
78.6th percentile
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope "Manager" role to add or edit `Script (Python)` objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web - which would be a very unusual configuration to begin with - are at risk. The problem has been fixed in AccessControl 4.3 and 5.2. Only AccessControl versions 4 and 5 are vulnerable, and only on Python 3, not Python 2.7. As a workaround, a site administrator can restrict adding/editing `Script (Python)` objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be assigned the Zope Manager role and adding/editing these scripts through the web should be restricted to trusted users only. This is the default configuration in Zope.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| zope | accesscontrol | >= 4.0 < 4.3 | 4.3 |
| zope | accesscontrol | >= 5.0 < 5.2 | 5.2 |
| zope | zope | >= 0 < f72a18dda8e9bf2aedb46168761668464a4be988 | f72a18dda8e9bf2aedb46168761668464a4be988 |
| zope | zope | >= 4.0 < 4.6.3 | 4.6.3 |
| zope | zope | >= 5.0 < 5.3 | 5.3 |
| zopefoundation | accesscontrol | — | — |
| zopefoundation | accesscontrol | — | — |
| zopefoundation | accesscontrol | >= 0 < b42dd4badf803bb9fb71ac34cd9cb0c249262f2c | b42dd4badf803bb9fb71ac34cd9cb0c249262f2c |
| zopefoundation | accesscontrol | >= 4.0 < 4.3 | 4.3 |
| zopefoundation | accesscontrol | >= 5.0 < 5.2 | 5.2 |
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Remote Code Execution via unsafe classes in otherwise permitted modules
osv·2021-08-05
CVE-2021-32807 [MEDIUM] Remote Code Execution via unsafe classes in otherwise permitted modules
Remote Code Execution via unsafe classes in otherwise permitted modules
### Impact
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects.
The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution.
By default, you need to have th
OSV
Remote Code Execution via Script (Python) objects under Python 3
osv·2021-08-05
CVE-2021-32807 [HIGH] Remote Code Execution via Script (Python) objects under Python 3
Remote Code Execution via Script (Python) objects under Python 3
### Impact
Background: The optional add-on package `Products.PythonScripts` adds `Script (Python)` to the list of content items a user can add to the Zope object database. Inside these scripts users can write Python code that is executed when rendered through the web. The code environment in these script objects is limited, it relies on the `RestrictedPython` package to provide a "safe" subset of Python instructions as well as the `AccessControl` package that defines security policies for execution in the context of a Zope application.
Recently the `AccessControl` package was updated to fix a remote code execution security issue. A link to the security advisory is provided in the References section below. The bug tightens t
GHSA
Remote Code Execution via unsafe classes in otherwise permitted modules
ghsa·2021-08-05
CVE-2021-32807 [MEDIUM] CWE-1321 Remote Code Execution via unsafe classes in otherwise permitted modules
Remote Code Execution via unsafe classes in otherwise permitted modules
### Impact
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects.
The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution.
By default, you need to have th
OSV
CVE-2021-32807: Zope is an open-source web application server
osv·2021-08-02
CVE-2021-32807 CVE-2021-32807: Zope is an open-source web application server
Zope is an open-source web application server. Zope versions prior to versions 4.6.3 and 5.3 have a remote code execution security issue. In order to be affected, one must use Python 3 for one's Zope deployment, run Zope 4 below version 4.6.3 or Zope 5 below version 5.3, and have the optional `Products.PythonScripts` add-on package installed. By default, one must have the admin-level Zope "Manager" role to add or edit Script (Python) objects through the web. Only sites that allow untrusted users to add/edit these scripts through the web are at risk. Zope releases 4.6.3 and 5.3 are not vulnerable. As a workaround, a site administrator can restrict adding/editing Script (Python) objects through the web using the standard Zope user/role permission mechanisms. Untrusted users should not be ass
OSV
CVE-2021-32807: The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications
osv·2021-07-30
CVE-2021-32807 CVE-2021-32807: The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications
The module `AccessControl` defines security policies for Python code used in restricted code within Zope applications. Restricted code is any code that resides in Zope's object database, such as the contents of `Script (Python)` objects. The policies defined in `AccessControl` severely restrict access to Python modules and only exempt a few that are deemed safe, such as Python's `string` module. However, full access to the `string` module also allows access to the class `Formatter`, which can be overridden and extended within `Script (Python)` in a way that provides access to other unsafe Python libraries. Those unsafe Python libraries can be used for remote code execution. By default, you need to have the admin-level Zope "Manager" role to add or edit `Script (Python)` objects through the
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst#51-2021-07-30https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2chttps://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgfhttps://github.com/zopefoundation/AccessControl/blob/master/CHANGES.rst#51-2021-07-30https://github.com/zopefoundation/AccessControl/commit/b42dd4badf803bb9fb71ac34cd9cb0c249262f2chttps://github.com/zopefoundation/AccessControl/security/advisories/GHSA-qcx9-j53g-ccgf
2021-07-30
Published