Skip to content
  • Home
  • About
  • Services
    • Vulnerability and Threat Intelligence
    • Threat Modeling and Risk Assessment
    • Penetration Testing
    • Source Code Review
    • Security Research
    • Security Consulting
  • Training
    • Kernel exploitation
      • Training – November 2019 – CLOSED
    • Kernel development
    • Userland exploitation
  • Labs
    • Exploits
    • Publications
    • Security Alerts
      • Latest Security Alerts
      • Latest Modified Security Alerts
      • Latest Ordered Security Alerts
      • Search Security Alert
  • Blog
  • Contact
  • Language
    • English
    • Português

Allele Security Intelligence

Efficient information security services

ASA-2018-00081 – TYPO3: Cross-Site Scripting in Frontend User Login

Posted on December 17, 2018February 1, 2019 by Allele Security Intelligence in Alerts

Allele Security Alert

ASA-2018-00081

Identifier(s)

ASA-2018-00081, TYPO3-CORE-SA-2018-008

Title

Cross-Site Scripting in Frontend User Login

Vendor(s)

TYPO3 Association

Product(s)

TYPO3

Affected version(s)

TYPO3 7.0.0-7.6.31, 8.0.0-8.7.20 and 9.0.0-9.5.1

Fixed version(s)

TYPO3 versions 7.6.32, 8.7.21 or 9.5.2

Proof of concept

Unknown

Description

Failing to properly encode user input, login status display is vulnerable to cross-site scripting in the website frontend. A valid user account is needed in order to exploit this vulnerability – either a backend user or a frontend user having the possibility to modify their user profile.

Technical details

Two occurrences allow to render data of the currently logged in frontend user that is not sanitized and thus allow XSS attacks by frontend users.

1. EXT:fe_login adds ###FEUSER_{fieldname}### for each field that exists in the fe_users DB table, which CAN be processed by TypoScript but is insecure by default.

2. config.USERNAME_substToken = <!–###USERNAME###–> sets the username dynamically, which is then insecure.

Credits

Thomas Löffler and Benni Mack (TYPO3 core team)

Reference(s)

TYPO3 9.5.2, 8.7.21 and 7.6.32 security releases published
https://typo3.org/article/typo3-952-8721-and-7632-security-releases-published/

TYPO3-CORE-SA-2018-008: Cross-Site Scripting in Frontend User Login
https://typo3.org/security/advisory/typo3-core-sa-2018-008/

[SECURITY] Prevent XSS with fe_users data in felogin/TSFE
https://github.com/TYPO3/TYPO3.CMS/commit/1c85fe70269e2ff8ecf0b6d5f16550c6cd0ddc78

[TYPO3-announce] Announcing TYPO3 v9.5.2, v8.7.21 and v7.6.32 security releases
http://lists.typo3.org/pipermail/typo3-announce/2018/000435.html

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: February 1, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.

Share this:

  • Click to print (Opens in new window)
  • Click to email a link to a friend (Opens in new window)
  • Click to share on Facebook (Opens in new window)
  • Click to share on LinkedIn (Opens in new window)
  • Click to share on Twitter (Opens in new window)
  • Click to share on Pocket (Opens in new window)
  • Click to share on Telegram (Opens in new window)
  • Click to share on WhatsApp (Opens in new window)

Like this:

Like Loading...

Related

Tagged ASA-2018-00081, Cross-Site Scripting, Frontend User Login, TYPO3, TYPO3-CORE-SA-2018-008

Post navigation

Previous Post ASA-2018-00080 – TYPO3: Cross-Site Scripting in Backend Modal Component
Next Post ASA-2018-00082 – TYPO3: Security Misconfiguration in Install Tool Cookie

Archives

  • September 2020 (10)
  • May 2020 (1)
  • March 2020 (1)
  • February 2020 (5)
  • December 2019 (33)
  • November 2019 (28)
  • October 2019 (54)
  • September 2019 (25)
  • August 2019 (46)
  • July 2019 (77)
  • June 2019 (95)
  • May 2019 (68)
  • April 2019 (77)
  • March 2019 (49)
  • February 2019 (78)
  • January 2019 (36)
  • December 2018 (38)
  • November 2018 (44)
  • October 2018 (20)
  • September 2018 (1)
  • August 2018 (1)

Tags

Apache HTTP Server (13) Apache Software Foundation (19) Arbitrary Code Execution (43) Arbitrary File Read (7) Authenticated User (13) Authentication Bypass (7) BIND (9) BIOS (9) Buffer Overflow (24) Code Execution (11) Command Injection (9) Cross-Site Request Forgery (13) Cross-Site Scripting (42) Cross-Site Scripting (XSS) (49) CSRF (12) curl (11) Das U-Boot (13) Denial of Service (DoS) (113) Deserialization (8) Facebook (11) Firmware (8) FreeBSD (24) Git (9) GitLab (15) Gitlab Community Edition (12) Gitlab Enterprise Edition (13) Go (7) Heap Buffer Overflow (23) IBM (13) IBM Sterling B2B Integrator Standard Edition (7) Improper Permissions (9) Information Disclosure (64) Integer Overflow (20) Intel (40) INTEL-SA-00248 (9) INTEL-SA-00264 (7) Intel Computer Card (7) Intel Computer Stick (7) Intel NUC (10) Intel Open CIT (8) Intel Open Cloud Integrity Technology (8) Jenkins (46) Joomla (10) Kubernetes (12) libssh2 (9) Linux (34) Linux Kernel (46) Local Access (27) MacOS (10) Magento (40) Memory Corruption (23) Memory Leak (13) mfsa2019-21 (21) MFSA2019-22 (6) MikroTik (10) MikroTik RouterOS (8) Mozilla (20) Mozilla Firefox (22) Mozilla Firefox ESR (8) Mozilla Thunderbird (11) NFS (7) NGINX (8) NULL Pointer Dereference (10) OpenBSD (11) OpenSSL (13) Out-Of-Bounds Read (41) Out-Of-Bounds Write (25) PIA (9) Private Internet Access (9) Privilege Escalation (99) Race Condition (12) rdesktop (19) Remote Code Execution (RCE) (64) rubygems (7) Samba (15) Sandbox Bypass (8) Security Bypass (8) Side Channel (8) SQL Injection (7) Stack Buffer Overflow (10) Stored Cross-Site Scripting (14) systemd (7) TCP (10) TYPO3 (32) TYPO3 CMS (7) Unbounded memcpy (7) Use-After-Free (28) VMware (25) VMware ESXI (9) VMware Fusion (8) VMware Workstation (9) WebKit (20) WebKitGTK (20) WhatsApp (9) Windows (12) Wind River (11) Wind River VxWorks (11) WPE Webkit (20) WSA-2019-0003 (20) Xen (8)
  • Twitter
  • Facebook
  • Github
  • Linkedin
  • RSS

Services

Vulnerability and Threat Intelligence

Threat Modeling and Risk Assessment

Penetration Testing

Source Code Review

Security Research

Security Consulting

Training

Kernel exploitation

Kernel development

Userland exploitation

Publications

Redução da superfície de ataque ao kernel do Linux – SEMCOMP 2019

Introdução à pesquisa em vulnerabilidades no núcleo do Linux – EnSI 2018

Introdução à pesquisa em vulnerabilidades no núcleo do Linux – RoadSec Salvador 2018

Rootkits em kernel space – Redshift, um rootkit para o kernel do FreeBSD

Public proofs of concept

CVE-2012-0217

CVE-2012-4576

latest security alerts

  • ASA-2020-00051 – Linux kernel: vsyscall page refcounting error September 16, 2020
  • ASA-2020-00050 – Linux kernel: Use-after-free vulnerability in cgroup BPF component September 16, 2020
  • ASA-2020-00049 – Linux kernel: Kernel stack information leak on s390/s390x platform September 12, 2020

Subscribe to our Blog

Enter your email address to subscribe to this blog and receive notifications of new posts by email.

© 2020 Allele Security Intelligence.
All rights reserved. Privacy Policy.

%d bloggers like this: