CVE-2024-23054

The ++plone++static/components path references an npm package that does not exist in the public package index (npm registry). This is a classic 'dependency confusion' attack (CWE-427 — uncontrolled search path element): if a dependency is not available in a private or internal source, the package manager may fall back to a package with the same name published in the public registry. An attacker can publish a malicious package under the missing name, which will be automatically downloaded and executed in the context of the Plone installation.

Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely (RCE) in the Docker container runtime environment, which may lead to complete instance takeover, data leakage, and further lateral movement in the infrastructure.

Apply patches available from the vendor according to the references. Additionally, it is recommended to block the ability to resolve npm dependencies from the public registry for internal packages and verify all dependencies listed in the configuration of Plone static components.

Plone Docker Official Image version 5.2.13 (build 5221)