PT-2024-40194 · Typo3 · Typo3

Published 2024-06-07 · Updated 2024-06-07

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TYPO3 (affected versions not specified)

Description: The issue allows backend users to upload certain file types, including *.phar, *.shtml, *.pl, or *.cgi files, due to missing file extensions in the TYPO3 CONF VARS configuration. These files can be executed in specific web server setups, potentially leading to security issues. A valid backend user account is required to exploit this issue. It is noted that derivatives of Debian GNU Linux handle *.phar files as PHP applications since PHP 7.1 and 7.2. The *.shtml file extension is related to server-side includes, which are not enabled by default in most Linux distributions. The *.pl and *.cgi file extensions require additional handlers to be configured, which is not typically the case in most common distributions.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

GHSA-8H4M-R4WM-XJ7R

Affected Products

Typo3

References · 6

• https://osv.dev/vulnerability/GHSA-8h4m-r4wm-xj7r · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/2019-01-22-7.yaml · Note
• https://github.com/TYPO3/typo3 · Note
• https://github.com/TYPO3/typo3/commit/095ae4ab6869d0f7dc7befedb851cdd7ad0c7ebf · Note
• https://github.com/TYPO3/typo3/commit/9990278ce7cf8e4d6b8bf31edec6787722d38b0f · Note
• https://typo3.org/security/advisory/typo3-core-sa-2019-008 · Note