CVE-2024-23756
📋 TL;DR
This vulnerability allows unauthenticated attackers to use HTTP PUT and DELETE methods in Plone Docker version 5.2.13, enabling them to upload malicious files or delete existing files on the server. It affects systems running the official Plone Docker image version 5.2.13 (build 5221).
💻 Affected Systems
- Plone CMS
📦 What is this software?
Plone by Plone
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise through remote code execution via uploaded malicious files, data destruction through file deletion, or website defacement.
Likely Case
Unauthorized file upload leading to webshell deployment, data exfiltration, or denial of service through file deletion.
If Mitigated
Limited impact if proper network segmentation and access controls prevent external access to vulnerable instances.
🎯 Exploit Status
Simple HTTP requests with PUT/DELETE methods can exploit this vulnerability without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Update to Plone Docker version 5.2.14 or later
Vendor Advisory: https://plone.org/security/advisories
Restart Required: Yes
Instructions:
1. Stop the vulnerable container. 2. Pull the updated image: docker pull plone:5.2.14. 3. Deploy the new container with your configuration.
🔧 Temporary Workarounds
Disable HTTP PUT/DELETE methods
allConfigure web server or reverse proxy to block PUT and DELETE HTTP methods
# For nginx: add 'limit_except GET POST { deny all; }' to location block
# For Apache: use 'LimitExcept GET POST' directive
Implement authentication requirement
allRequire authentication for all HTTP methods including PUT and DELETE
# Configure Plone security to require authentication for all methods
🧯 If You Can't Patch
- Isolate vulnerable instances behind a WAF or reverse proxy that blocks PUT/DELETE methods
- Implement strict network access controls to limit exposure to trusted sources only
🔍 How to Verify
Check if Vulnerable:
Test if HTTP PUT or DELETE methods are accepted without authentication: curl -X PUT http://target/ or curl -X DELETE http://target/Check Version:
docker inspect plone_container | grep -i versionVerify Fix Applied:
After patching, verify PUT and DELETE methods are rejected or require authentication using the same curl commands.📡 Detection & Monitoring
Log Indicators:
- HTTP 200/201 responses to PUT requests
- HTTP 200/204 responses to DELETE requests
- Unauthenticated file upload attempts
Network Indicators:
- HTTP PUT/DELETE requests to Plone endpoints
- Unusual file upload patterns
SIEM Query:
http.method IN ("PUT", "DELETE") AND http.url CONTAINS "plone" AND NOT auth.success