PT-2024-40242 · Typo3 · Typo3

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TYPO3 (affected versions not specified)

Description: The issue arises from Phar files, which can act as self-extracting archives, leading to the execution of source code when invoked. Phar files can be disguised with various file extensions, allowing them to be uploaded and persisted to a TYPO3 installation without being denied. A missing sanitization of user input enables these Phar files to be invoked by manipulated URLs in TYPO3 backend forms. A valid backend user account is required to exploit this issue. While the attack vector could potentially be used in the TYPO3 frontend, no functional exploit has been identified yet.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

GHSA-CC97-G92W-JM65

Affected Products

Typo3

References · 8

• https://osv.dev/vulnerability/GHSA-cc97-g92w-jm65 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2018-07-12-2.yaml · Note
• https://github.com/TYPO3-CMS/core · Note
• https://github.com/TYPO3-CMS/core/commit/81c6e9e6e49ee4f924bd340fb007d271fa44aa16 · Note
• https://github.com/TYPO3-CMS/core/commit/aa4e270d04313fe7d8ea508a9c694db83875e981 · Note
• https://github.com/TYPO3-CMS/core/commit/dd0487bd8b4ec7204dbfff2b5812d797102a1778 · Note
• https://github.com/TYPO3-CMS/core/commit/854d03841b42123ab744c2591199b76ce65a8e45 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2018-002 · Note