It has been discovered that FormEngine and DataHandler are vulnerable to insecure deserialization. A valid backend user account is needed in order to exploit this vulnerability.
Tag: TYPO3 CMS
ASA-2019-00418 – TYPO3: Arbitrary Code Execution and Cross-Site Scripting in Backend API
Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings. A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfig_includes is needed in order to exploit this vulnerability.
ASA-2019-00417 – TYPO3: Security Misconfiguration in Frontend Session Handling
It has been discovered session data of properly authenticated and logged in frontend users is kept and transformed into an anonymous user session during the logout process. This way the next user using the same client application gains access to previous session data.
ASA-2019-00416 – TYPO3: Broken Access Control in Import Module
It has been discovered that the Import/Export module is susceptible to broken access control. Regular backend users have access to import functionality which usually only is available to admin users or users having User TSconfig setting options.impexp.enableImportForNonAdminUser explicitly enabled. Database content to be imported however was correctly checked against users’ permissions and not affected. However it was possible to upload files by-passing restrictions of the file abstraction layer (FAL) - however this did not affect executable files which have been correctly secured by fileDenyPattern. Currently the only known vulnerability is to directly inject *.form.yaml files which could be used to trigger the vulnerability of TYPO3-CORE-SA-2018-003 (privilege escalation & SQL injection) - which requires the Form Framework (ext:form) being available on an according website.
ASA-2019-00415 – TYPO3: Possible deserialization side-effects in symfony/cache
Identifier(s) ASA-2019-00415, CVE-2019-10912, TYPO3-CORE-SA-2019-016 Title Possible deserialization side-effects in symfony/cache Vendor(s) TYPO3 Association Product(s) TYPO3 CMS Affected version(s) TYPO3 CMS versions 9.4.0 to 9.5.7 Fixed version(s) TYPO3 CMS version 9.5.8 Proof of concept Unknown Description Third party component symfony/cache could have been potentially leading to removal of arbitrary files in combination with other insecure deserialization … Continue reading ASA-2019-00415 – TYPO3: Possible deserialization side-effects in symfony/cache
ASA-2019-00414 – TYPO3: Cross-Site Scripting in Link Handling
It has been discovered that the t3:// URL handling is vulnerable to cross-site scripting when making use of javascript: or data: scheme in link fields like the following.
ASA-2019-00413 – TYPO3: Information Disclosure in Backend User Interface
The element information component used to display properties of a certain record is susceptible to information disclosure. The list of references from or to the record is not properly checked for the backend user’s permissions. A valid backend user account is needed in order to exploit this vulnerability.