Description

plone.app.portlets provides portlets and a Plone-specific user interface for plone.portlets. Prior to 5.0.8, 6.0.4, and 7.0.2, a member who can add an RSS portlet can set its feed URL to a very large response, causing src/plone/app/portlets/portlets/rss.py to download and retain excessive data in memory and deny service. The same RSS URL handling accepts internal hosts, IP addresses, single-word domains, and explicit ports, allowing server-side requests that can probe internal network services and open ports. A malicious feed item can also supply a JavaScript URL that is retained as the item link and can execute script when used by a victim. The affected logic includes _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, RSSFeed._buildItemDict, and the FEED_DATA in-memory cache. This issue is fixed in versions 5.0.8, 6.0.4, and 7.0.2.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.1",
  "pubDate": "2026-08-28T20:18:27.030Z",
  "pubdate": "2026-08-28T20:18:27.030Z",
  "executiveSummary": "The vulnerability in plone.app.portlets involves a combination of Server-Side Request Forgery (SSRF), Denial of Service (DoS), and Stored Cross-Site Scripting (XSS) via the RSS portlet functionality.\nThe flaw stems from insufficient validation of user-supplied RSS feed URLs, allowing authenticated members with portlet-adding privileges to force the server to fetch arbitrary, potentially large, or internal resources.\nAttackers can leverage this to exhaust server memory, probe internal network infrastructure, and inject malicious scripts into the application to target other users.\nThe vulnerability affects plone.app.portlets versions prior to 5.0.8, 6.0.4, and 7.0.2.\nThe risk profile is significant as it permits lateral movement within internal networks, resource exhaustion of the Plone instance, and compromise of user sessions via script injection.\nExploitation requires authenticated access to the Plone interface with sufficient permissions to add and configure portlets.",
  "technicalDetails": "The root cause of these vulnerabilities lies in the inadequate sanitization and validation logic within src/plone/app/portlets/portlets/rss.py, specifically in the _rss_feed_url_validator, _normal_url_validator, RSSFeed._retrieveFeed, and RSSFeed._buildItemDict functions.\nRegarding the Denial of Service (DoS) and SSRF: The application fails to enforce strict URL schemes or host-filtering policies. By providing a malicious URL pointing to a large response payload, an attacker can trigger RSSFeed._retrieveFeed to download excessive data, which is then stored in the FEED_DATA in-memory cache, leading to severe memory exhaustion. Furthermore, the lack of host validation allows the application to perform requests against internal network services, IP addresses, and custom ports, effectively functioning as a proxy for SSRF attacks against internal infrastructure unreachable from the public internet.\nRegarding the Stored XSS: The RSSFeed._buildItemDict function fails to sanitize the links extracted from RSS feed items. A malicious feed provider can include a 'javascript:' URI in the link field. When this data is retrieved and stored by the portal, the malicious script is persisted. When a victim subsequently interacts with the portlet, the browser renders the link, executing the attacker's script in the context of the victim's session.\nThe attack flow for SSRF/DoS follows these steps: 1. The attacker authenticates as a user with portlet-management privileges. 2. The attacker adds an RSS portlet and inputs a crafted URL targeting an internal resource or a resource designed to cause memory bloat. 3. The server processes the request via _rss_feed_url_validator, which fails to restrict the target destination. 4. RSSFeed._retrieveFeed initiates the outbound connection. 5. The system fetches the content and caches it, resulting in resource exhaustion or internal network mapping.\nThe attack flow for XSS follows these steps: 1. The attacker hosts an RSS feed containing an item with a 'javascript:' URL in its link attribute. 2. The attacker configures the Plone RSS portlet to consume this feed. 3. The server fetches and parses the feed via RSSFeed._buildItemDict. 4. The malicious link is stored in the site's data structure. 5. Any user viewing the rendered portlet triggers the malicious script execution."
}