CVE-2023-42457 plone.rest vulnerable to Denial of Service when ++api++ is used many times
Repeated use of the ++api++ traverser in URLs causes excessive processing time, leading to server unresponsiveness in plone.rest.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-42457?
CVE-2023-42457 is a high-severity denial of service vulnerability in plone.rest, published on 21 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
plone.rest allows users to use HTTP verbs such as GET, POST, PUT, DELETE, etc. in Plone. Starting in the 2.x branch and prior to versions 2.0.1 and 3.0.1, when the `++api++` traverser is accidentally used multiple times in a url, handling it takes increasingly longer, making the server less responsive. Patches are available in `plone.rest` 2.0.1 and 3.0.1. Series 1.x is not affected. As a workaround, one may redirect `/++api++/++api++` to `/++api++` in one's frontend web server (nginx, Apache).
Which versions are affected by CVE-2023-42457?
5 open source packages ship an affected version, including plone.rest and plone-rest. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
plone.rest PyPI | From 2.0.0a1 | 2.0.1 |
plone.rest PyPI | From 3.0.0 | 3.0.1 |
plone-rest PyPI | All versions | None |
plone-rest PyPI | From 2.0.0a1 | 2.0.1 |
plone-rest PyPI | From 3.0.0 | 3.0.1 |
Products include Plone Rest.
How do I fix CVE-2023-42457?
Upgrade plone.rest to a fixed version for your release line: 2.0.1 or 3.0.1.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-42457 being exploited?
There is no known exploitation of CVE-2023-42457 in the wild and no public exploit code.
Sources
Also known as GHSA-h6rp-mprm-xgcq, PYSEC-2023-178.