CVE-2009-3633: TYPO3 CMS-Core API function vulnerable to Cross-site Scripting
Summary
CVE-2009-3633: TYPO3 API function vulnerable to Cross-site Scripting. Affects typo3/cms-core across 4 version ranges.
< 4.0.13
>= 4.1.0, < 4.1.13
>= 4.2.0, < 4.2.10
>= 4.3alpha1, < 4.3beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including a powerful API for developers to extend and customize the system. However, versions 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 are vulnerable to a Cross-site Scripting (XSS) attack.
Vulnerability Detail
The vulnerability exists in the t3lib_div::quoteJSvalue API function, which is used for sanitizing user input. Due to a flaw in the sanitizing algorithm, remote attackers can inject arbitrary web script or HTML into the application. This can lead to various security risks, including session hijacking, defacement of web pages, and theft of sensitive information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.0.134.0.13composer require typo3/cms-core:4.0.13 -
>= 4.1.0, < 4.1.134.1.13composer require typo3/cms-core:4.1.13 -
>= 4.2.0, < 4.2.104.2.10composer require typo3/cms-core:4.2.10 -
>= 4.3alpha1, < 4.3beta24.3beta2composer require typo3/cms-core:4.3beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by manually modifying the t3lib_div::quoteJSvalue function to use a more secure sanitizing algorithm. Here is an example of the modified code:
class t3lib_div {
public static function quoteJSvalue($value) {
// Custom secure sanitizing algorithm
$sanitizedValue = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
return $sanitizedValue;
}
}
Please note that this is a temporary solution and it is strongly recommended to upgrade to the latest version as soon as possible.
Conclusion
In conclusion, TYPO3 CMS-Core versions 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 are vulnerable to a Cross-site Scripting (XSS) attack. It is crucial to upgrade to the latest version or apply the provided workaround to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, making it a popular choice for website development.
Cross-site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking, defacement of web pages, and theft of sensitive information.
The vulnerability exists in the t3lib_div::quoteJSvalue API function, which is responsible for sanitizing user input. Due to a flaw in the sanitizing algorithm, attackers can inject arbitrary web script or HTML into the application, potentially leading to XSS attacks.
The vulnerability can be exploited by attackers to perform various malicious activities, including session hijacking, defacement of web pages, and theft of sensitive information. It is important to patch the vulnerability to prevent these risks.
To fix this vulnerability, it is recommended to upgrade to the latest version of TYPO3 CMS-Core (4.1.13, 4.2.10, or 4.3beta2). This will ensure that the vulnerable API function is patched and the application is protected against XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
