CVE-2020-35190
📋 TL;DR
This vulnerability allows remote attackers to gain root access to systems running affected Plone Docker images by using a blank password for the root user. It affects deployments using official Plone Docker images before version 4.3.18-alpine. This is a critical authentication bypass vulnerability.
💻 Affected Systems
- Plone Docker Official Image
📦 What is this software?
Plone by Plone
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with root-level access, allowing attackers to install malware, exfiltrate data, pivot to other systems, or destroy the container environment.
Likely Case
Unauthorized root access leading to data theft, service disruption, and potential lateral movement within the network.
If Mitigated
Limited impact if container runs with non-root user, network isolation, and proper access controls are implemented.
🎯 Exploit Status
Exploitation requires only SSH or direct container access with blank password. Simple password brute-forcing or manual login attempts can succeed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.3.18-alpine and later
Vendor Advisory: https://github.com/plone/plone.docker
Restart Required: Yes
Instructions:
1. Stop affected containers. 2. Pull updated image: docker pull plone:4.3.18-alpine. 3. Recreate containers with updated image. 4. Verify no containers use vulnerable versions.
🔧 Temporary Workarounds
Set root password
linuxManually set a strong password for root user in running containers
docker exec -it <container_name> passwd root
Run as non-root user
linuxConfigure container to run Plone as non-root user
docker run -u 1000:1000 plone:<version>
🧯 If You Can't Patch
- Implement strict network segmentation to isolate vulnerable containers
- Deploy host-based intrusion detection and monitor for root login attempts
🔍 How to Verify
Check if Vulnerable:
Check Docker image version: docker images | grep plone. If version is earlier than 4.3.18-alpine, it's vulnerable.Check Version:
docker images --format '{{.Repository}}:{{.Tag}}' | grep ploneVerify Fix Applied:
Verify running containers use patched version: docker ps --format 'table {{.Names}}\t{{.Image}}' | grep plone. Ensure all show 4.3.18-alpine or later.📡 Detection & Monitoring
Log Indicators:
- Failed or successful root login attempts with blank password
- SSH authentication logs showing root access
Network Indicators:
- Unexpected SSH connections to container IPs
- Traffic from containers to suspicious external IPs
SIEM Query:
source="docker" OR source="auth" (user="root" AND (password="" OR auth_method="password"))