CVE-2023-42457
📋 TL;DR
This CVE describes a denial-of-service vulnerability in plone.rest where repeated use of the `++api++` traverser in URLs causes increasing processing time, making the server less responsive. It affects Plone installations using plone.rest versions 2.x (before 2.0.1) and 3.x (before 3.0.1). Series 1.x is not affected.
💻 Affected Systems
- plone.rest
📦 What is this software?
Rest by Plone
Rest by Plone
⚠️ Risk & Real-World Impact
Worst Case
Complete server unresponsiveness due to resource exhaustion from repeated malicious requests, potentially causing extended service downtime.
Likely Case
Degraded server performance and increased response times affecting legitimate users, potentially leading to partial service disruption.
If Mitigated
Minimal impact with proper patching or workarounds in place, maintaining normal server operations.
🎯 Exploit Status
Exploitation requires only HTTP requests with repeated ++api++ segments in URLs, making it trivial to weaponize.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: plone.rest 2.0.1 and 3.0.1
Vendor Advisory: https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
Restart Required: Yes
Instructions:
1. Update plone.rest to version 2.0.1 (for 2.x branch) or 3.0.1 (for 3.x branch). 2. Restart the Plone application server. 3. Verify the fix by testing URLs with repeated ++api++ segments.
🔧 Temporary Workarounds
Web Server Redirect
allRedirect URLs containing /++api++/++api++ to /++api++ at the web server level
# Apache example
RewriteRule ^/\+\+api\+\+/\+\+api\+\+(.*)$ /++api++$1 [R=301,L]
# Nginx example
rewrite ^/\+\+api\+\+/\+\+api\+\+(.*)$ /++api++$1 permanent;
🧯 If You Can't Patch
- Implement web server redirect workaround as described above
- Implement rate limiting or WAF rules to block requests with repeated ++api++ segments
🔍 How to Verify
Check if Vulnerable:
Test by accessing a URL like /++api++/++api++/some-endpoint and measuring response time. If response time increases significantly with each additional ++api++ segment, the system is vulnerable.Check Version:
Check plone.rest version in Plone's add-ons control panel or via pip: pip show plone.restVerify Fix Applied:
After patching, test the same URLs - response times should remain consistent regardless of ++api++ repetitions.📡 Detection & Monitoring
Log Indicators:
- Multiple consecutive ++api++ segments in URL paths
- Unusually long request processing times for API endpoints
- Increased CPU/memory usage on Plone servers
Network Indicators:
- HTTP requests with patterns like /++api++/++api++/++api++
- Spike in requests to API endpoints
SIEM Query:
url.path CONTAINS '++api++/++api++' AND response_time > 5000🔗 References
- http://www.openwall.com/lists/oss-security/2023/09/22/2
- https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
- https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
- https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
- http://www.openwall.com/lists/oss-security/2023/09/22/2
- https://github.com/plone/plone.rest/commit/43b4a7e86206e237e1de5ca3817ed071575882f7
- https://github.com/plone/plone.rest/commit/77846a9842889b24f35e8bedc2e9d461388d3302
- https://github.com/plone/plone.rest/security/advisories/GHSA-h6rp-mprm-xgcq
