Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability lies in the clipboard functionality of django CMS, specifically within the PlaceholderAdmin class in cms/admin/placeholderadmin.py. The core issue is a failure to enforce authorization on the source of a copy operation. When a user copies plugins, either individually or by copying an entire placeholder, the system only checks if the user has permission to add content to the destination (their own clipboard). It completely neglects to check if the user has permission to read from the source placeholder.
As demonstrated in the patch, the functions _copy_plugin_to_clipboard and _copy_placeholder_to_clipboard were missing crucial permission checks. The fix was to add calls to source_placeholder.has_add_plugins_permission(request.user, old_plugins) and source_placeholder.check_source(request.user). Before this fix, a low-privileged staff user could craft a request to the copy_plugins admin endpoint, specifying the ID of a placeholder they were not authorized to view. The system would then copy the plugins from that restricted placeholder into the user's clipboard, allowing them to view and exfiltrate potentially sensitive content. The identified vulnerable functions are the direct entry points for this insecure copy operation.
PlaceholderAdmin._copy_plugin_to_clipboardcms/admin/placeholderadmin.py
PlaceholderAdmin._copy_placeholder_to_clipboardcms/admin/placeholderadmin.py
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| django-cms | pip | < 5.0.8 | 5.0.8 |