CVE-2009-3631: TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name
Summary
CVE-2009-3631: TYPO3 Backend Command Injection via Shell Metacharacters in Uploaded File Name. Affects typo3/cms-backend across 4 version ranges.
< 4.0.13
>= 4.1.0, < 4.1.13
>= 4.2.0, < 4.2.10
>= 4.3alpha1, < 4.3beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The TYPO3 Backend is the administrative interface of the CMS, allowing users to manage and configure their TYPO3 installations. The Backend subcomponent in TYPO3 versions 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 is vulnerable to a command injection attack. This vulnerability occurs when the DAM extension or FTP upload is enabled. An authenticated remote user can exploit this vulnerability by uploading a file with shell metacharacters in its name, allowing them to execute arbitrary commands on the server.
Vulnerability Detail
The vulnerability in TYPO3 Backend allows remote authenticated users to execute arbitrary commands on the server. By uploading a file with shell metacharacters in its name, an attacker can manipulate the command execution and potentially gain unauthorized access to the server. This can lead to various security risks, including data breaches, unauthorized modifications, and further exploitation of the compromised system. The vulnerability is classified as CWE-94 (Improper Control of Generation of Code).
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.0.134.0.13composer require typo3/cms-backend:4.0.13 -
>= 4.1.0, < 4.1.134.1.13composer require typo3/cms-backend:4.1.13 -
>= 4.2.0, < 4.2.104.2.10composer require typo3/cms-backend:4.2.10 -
>= 4.3alpha1, < 4.3beta24.3beta2composer require typo3/cms-backend:4.3beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can disable the DAM extension or FTP upload in TYPO3 Backend. This can be done by accessing the TYPO3 configuration files and modifying the relevant settings. For example, to disable the DAM extension, users can set the 'enabled' flag to 'false' in the TYPO3 configuration file. Similarly, FTP upload can be disabled by setting the 'enableFtp' flag to 'false'. It is important to note that disabling these features may impact the functionality of the TYPO3 installation, so it is recommended to apply the official patch as soon as possible.
Conclusion
The TYPO3 Backend Command Injection vulnerability allows remote authenticated users to execute arbitrary commands on the server. It is crucial for TYPO3 users to update their installations to the latest patched versions and apply the recommended fixes. Disabling the DAM extension or FTP upload can serve as a temporary workaround until the official patch is applied. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-backend →
FAQ
TYPO3 is an open-source content management system (CMS) used for building websites and web applications.
The TYPO3 Backend is the administrative interface of the TYPO3 CMS, allowing users to manage and configure their TYPO3 installations.
The vulnerability occurs when the DAM extension or FTP upload is enabled in TYPO3 Backend. An authenticated remote user can exploit this vulnerability by uploading a file with shell metacharacters in its name.
The vulnerability can lead to unauthorized command execution on the server, potentially resulting in data breaches, unauthorized modifications, and further exploitation of the compromised system.
To fix this vulnerability, TYPO3 users should update their installations to the latest patched versions and disable the DAM extension or FTP upload if not required.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-backend.
