ASA-2019-00418 – TYPO3: Arbitrary Code Execution and Cross-Site Scripting in Backend API


Allele Security Alert

ASA-2019-00418

Identifier(s)

ASA-2019-00418, TYPO3-CORE-SA-2019-019

Title

Arbitrary Code Execution and Cross-Site Scripting in Backend API

Vendor(s)

TYPO3 Association

Product(s)

TYPO3 CMS

Affected version(s)

TYPO3 CMS versions 8.0.0 to 8.7.26
TYPO3 CMS versions 9.0.0 to 9.5.7

Fixed version(s)

TYPO3 CMS version 8.7.27
TYPO3 CMS version 9.5.8

Proof of concept

Unknown

Description

Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and Cross-Site Scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings.

A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfig_includes is needed in order to exploit this vulnerability.

Technical details

Unknown

Credits

Benjamin Kott and Oliver Hader

Reference(s)

TYPO3 9.5.8 and 8.7.27 security releases published
https://typo3.org/article/typo3-958-and-8727-security-releases-published/

TYPO3-CORE-SA-2019-019: Arbitrary Code Execution and Cross-Site Scripting in Backend API
https://typo3.org/security/advisory/typo3-core-sa-2019-019/

[TYPO3-announce] Announcing TYPO3 v9.5.8 and v8.7.27 security releases
http://lists.typo3.org/pipermail/typo3-announce/2019/000447.html

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: July 11, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.