PT-2024-40269 · Typo3 · Typo3

Published 2024-05-30 · Updated 2024-05-30

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: TYPO3 (affected versions not specified)

Description: The issue allows backend users to upload certain file types, including *.phar, *.shtml, *.pl, or *.cgi files, due to missing file extensions in the $GLOBALS['TYPO3 CONF VARS']['BE']['fileDenyPattern'] setting. This can be exploited if a valid backend user account is available. In certain web server setups, these uploaded files can be executed. Specifically, derivatives of Debian GNU Linux handle *.phar files as PHP applications since PHP 7.1 and 7.2. The *.shtml file extension is related to server-side includes, which are not enabled by default in most Linux distributions. The *.pl and *.cgi file extensions require additional handlers to be configured, which is not typically the case in most common distributions.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

GHSA-F9HR-7CFQ-MJG2

Affected Products

Typo3

References · 6

• https://osv.dev/vulnerability/GHSA-f9hr-7cfq-mjg2 · Vendor Advisory
• https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/2019-01-22-7.yaml · Note
• https://github.com/TYPO3-CMS/core · Note
• https://github.com/TYPO3-CMS/core/commit/5095084efae471c5fef7b578f2bc8a5060e1e148 · Note
• https://github.com/TYPO3-CMS/core/commit/45c311d120c359d54cc918e962c374e774239899 · Note
• https://typo3.org/security/advisory/typo3-core-sa-2019-008 · Note