PT-2024-20762 · Typo3 · Typo3

Oliver Hader · Published 2024-02-13 · Updated 2024-10-16 · CVE-2024-25121

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 8.7.57 ELTS TYPO3 versions prior to 9.5.46 ELTS TYPO3 versions prior to 10.4.43 ELTS TYPO3 versions prior to 11.5.35 LTS TYPO3 versions prior to 12.4.11 LTS TYPO3 versions prior to 13.0.1

Description In affected versions of TYPO3, entities of the File Abstraction Layer (FAL) could be persisted directly via DataHandler. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this issue requires a valid backend user account.

Recommendations Update to TYPO3 version 8.7.57 ELTS or later. Update to TYPO3 version 9.5.46 ELTS or later. Update to TYPO3 version 10.4.43 ELTS or later. Update to TYPO3 version 11.5.35 LTS or later. Update to TYPO3 version 12.4.11 LTS or later. Update to TYPO3 version 13.0.1 or later. As a temporary workaround, consider restricting access to the DataHandler and limiting the ability to persist entities of the File Abstraction Layer directly. When importing data from secure origins, explicitly enable it in the corresponding DataHandler instance by using $dataHandler->isImporting = true;.

Exploit

Fix

Improper Access Control

Information Disclosure

Weakness Enumeration

CWE-284

CWE-200

Related Identifiers

CVE-2024-25121

GHSA-RJ3X-WVC6-5J66

Affected Products

Typo3

References · 13

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25121.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-25121 · Security Note
• https://typo3.org/security/advisory/typo3-core-sa-2024-006 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-25121 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-rj3x-wvc6-5j66 · Vendor Advisory
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/security/advisories/GHSA-rj3x-wvc6-5j66 · Note
• https://github.com/TYPO3/typo3/commit/71e652bf84b16fd3592205f61f36750ab03db74c · Note
• https://github.com/TYPO3/typo3/commit/b47b6ddf5a5f3f852c6e43f837360780c12e3c47 · Note
• https://github.com/TYPO3/typo3/commit/38f0bf9a61e10365be26eb75bc23a81184dbed07 · Note
• https://t.me/cvenotify/71359 · Telegram Post
• https://twitter.com/CVEnew/status/1757532997476081867 · Twitter Post
• https://t.me/cvenotify/98326 · Telegram Post