CVE-2023-36814
📋 TL;DR
CVE-2023-36814 is a vulnerability in Products.CMFCore that allows unauthenticated attackers to cause denial of service and crashes by exploiting unsafe use of Python's marshal module. All deployments using Products.CMFCore-based portal software like Plone are affected. The vulnerability is exposed through a public method on PortalFolder objects.
💻 Affected Systems
- Products.CMFCore
- Plone
- Other Zope CMF-based portal software
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service disruption through application crashes, potentially requiring manual intervention to restore functionality.
Likely Case
Service degradation or temporary unavailability due to application crashes triggered by malicious requests.
If Mitigated
Minimal impact with proper network controls and monitoring to detect and block exploitation attempts.
🎯 Exploit Status
The vulnerability is in a public method and requires no authentication, making exploitation straightforward.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Products.CMFCore 3.2
Vendor Advisory: https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87
Restart Required: Yes
Instructions:
1. Update Products.CMFCore to version 3.2 or later using pip or your package manager. 2. Restart the Zope/Plone application server. 3. Verify the update was successful.
🔧 Temporary Workarounds
Network Access Control
allRestrict access to affected services to trusted networks only.
Web Application Firewall Rules
allImplement WAF rules to block requests targeting the vulnerable PortalFolder method.
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to vulnerable systems
- Deploy monitoring and alerting for application crashes or unusual traffic patterns
🔍 How to Verify
Check if Vulnerable:
Check if Products.CMFCore version is below 3.2 in your Python environment or Plone/Zope installation.Check Version:
pip show Products.CMFCore | grep VersionVerify Fix Applied:
Confirm Products.CMFCore version is 3.2 or higher after patching.📡 Detection & Monitoring
Log Indicators:
- Application crash logs
- Error messages related to marshal module
- Unusual request patterns to PortalFolder endpoints
Network Indicators:
- HTTP requests to PortalFolder methods with unusual payloads
- Spike in error responses from the application
SIEM Query:
source="application.log" AND ("marshal" OR "PortalFolder" OR "crash")🔗 References
- https://github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5
- https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87
- https://github.com/zopefoundation/Products.CMFCore/commit/40f03f43a60f28ca9485c8ef429efef729be54e5
- https://github.com/zopefoundation/Products.CMFCore/security/advisories/GHSA-4hpj-8rhv-9x87
