CVE-2009-3636: Typo3 API Install Tool Cross-site Scripting Vulnerability
Summary
CVE-2009-3636: Typo3 API Install Tool vulnerable to Cross-site Scripting. Affects typo3/cms-install across 4 version ranges.
< 4.0.13
>= 4.1.0, < 4.1.13
>= 4.2.0, < 4.2.10
>= 4.3alpha1, < 4.3beta2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Typo3 is an open-source content management system (CMS) written in PHP. The Install Tool is a subcomponent of Typo3 that provides a web-based interface for configuring and installing the CMS. It allows administrators to perform various tasks such as setting up the database, configuring extensions, and managing system settings. However, versions 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 of Typo3's Install Tool are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The XSS vulnerability in Typo3's Install Tool allows remote attackers to inject arbitrary web script or HTML into the application. This can lead to various security risks, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the website. The exact parameters that are vulnerable to XSS are unspecified in the advisory.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.0.134.0.13composer require typo3/cms-install:4.0.13 -
>= 4.1.0, < 4.1.134.1.13composer require typo3/cms-install:4.1.13 -
>= 4.2.0, < 4.2.104.2.10composer require typo3/cms-install:4.2.10 -
>= 4.3alpha1, < 4.3beta24.3beta2composer require typo3/cms-install:4.3beta2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a fixed version is not immediately possible, users can implement input validation and output encoding to mitigate the risk of XSS attacks. This involves sanitizing user input and encoding output to prevent the execution of malicious scripts. Here is an example of input validation using PHP's filter_var() function:
$input = $_GET['input'];
if (filter_var($input, FILTER_VALIDATE_EMAIL)) {
// Valid email address
} else {
// Invalid email address
}
Conclusion
The XSS vulnerability in Typo3's Install Tool can be mitigated by upgrading to a fixed version or implementing input validation and output encoding. It is important to promptly address this vulnerability to prevent potential security breaches. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms-install →
FAQ
The vulnerability allows attackers to inject malicious scripts or HTML into the application, potentially leading to unauthorized actions, data theft, or website defacement.
No, only versions 4.0.13 and earlier, 4.1.x before 4.1.13, 4.2.x before 4.2.10, and 4.3.x before 4.3beta2 are vulnerable to this XSS issue.
Yes, users can implement input validation and output encoding to mitigate the risk of XSS attacks. However, upgrading to a fixed version is the recommended solution.
Yes, this vulnerability has been assigned the CVE identifier CVE-2009-3636.
You can find more information about this vulnerability in the Typo3 advisory at the following URL: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-c73w-4rcj-2622/GHSA-c73w-4rcj-2622.json
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-install.
