CVE-2022-23599: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Products.ATContentTypes are the core content types for Plone 2.1 - 4.3. Versions of Plone that are dependent on Products.ATContentTypes prior to version 3.0.6 are vulnerable to reflected cross site scripting and open redirect when an attacker can get a compromised version of the image_view_fullscreen page in a cache, for example in Varnish. The technique is known as cache poisoning. Any later visitor can get redirected when clicking on a link on this page. Usually only anonymous users are affected, but this depends on the user's cache settings. Version 3.0.6 of Products.ATContentTypes has been released with a fix. This version works on Plone 5.2, Python 2 only. As a workaround, make sure the image_view_fullscreen page is not stored in the cache. More information about the vulnerability and cvmitigation measures is available in the GitHub Security Advisory.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 6.1
Published: 2022-01-28T22:15Z
Repository: https://github.com/plone/Products.ATContentTypes
Language: Other
Files changed: Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt, news/1.bugfix
Commit date: 2022-01-21 01:09:14 +0100
Commit message: Security fix: prevent cache poisoning with the Referer header.

See [security advisory](https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh).

Diff: diff --git a/Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt b/Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt
index a22af266..e21f8500 100644
--- a/Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt
+++ b/Products/ATContentTypes/skins/ATContentTypes/image_view_fullscreen.pt
@@ -44,19 +44,23 @@
 </head>
 
 <body>
 
 <div id="content-core">
+  <tal:block define="referer request/HTTP_REFERER;
+                     url_tool nocall:context/portal_url;
+                     referer python:referer if referer and url_tool.isURLInPortal(referer) else '';">
     <a href=""
-       tal:attributes="href request/HTTP_REFERER"
-       tal:condition="request/HTTP_REFERER"
+       tal:attributes="href referer"
+       tal:condition="referer"
        ><span i18n:translate="label_back_to_site">Back to site</span><br /><tal:block replace="structure context/tag" /></a>
 
     <a href=""
-       tal:attributes="href context/portal_url"
-       tal:condition="not: request/HTTP_REFERER"
+       tal:attributes="href python:url_tool()"
+       tal:condition="not: referer"
        ><span i18n:translate="label_home">Home</span><br /><tal:block replace="structure context/tag" /></a>
+      </tal:block>
 </div>
 
 </body>
 </html>
 
diff --git a/news/1.bugfix b/news/1.bugfix
new file mode 100644
index 00000000..0f70abe9
--- /dev/null
+++ b/news/1.bugfix
@@ -0,0 +1,3 @@
+Security fix: prevent cache poisoning with the Referer header.
+See `security advisory <https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh>`.
+[maurits]

Vulnerable code:        tal:attributes="href request/HTTP_REFERER"
       tal:condition="request/HTTP_REFERER"
       tal:attributes="href context/portal_url"
       tal:condition="not: request/HTTP_REFERER"
Fixed code:   <tal:block define="referer request/HTTP_REFERER;
                     url_tool nocall:context/portal_url;
                     referer python:referer if referer and url_tool.isURLInPortal(referer) else '';">
       tal:attributes="href referer"
       tal:condition="referer"
       tal:attributes="href python:url_tool()"
       tal:condition="not: referer"
      </tal:block>
Security fix: prevent cache poisoning with the Referer header.
See `security advisory <https://github.com/plone/Products.ATContentTypes/security/advisories/GHSA-g4c2-ghfg-g5rh>`.
[maurits]