CVE-2010-3672: TYPO3 CMS-Fluid Cross-Site Scripting Vulnerability
Summary
CVE-2010-3672: TYPO3 vulnerable to Cross-Site Scripting in the textarea view helper. Affects typo3/cms-fluid across 2 version ranges.
< 4.3.4
>= 4.4.0, < 4.4.1
Fixed in 4.3.4 or 4.4.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Fluid is an extbase extension for TYPO3, a popular open-source content management system. It provides a set of view helpers to simplify the creation of fluid templates. The textarea view helper, which is vulnerable to cross-site scripting (XSS), allows developers to generate HTML textarea elements with predefined content.
Vulnerability Detail
The vulnerability (CVE-2010-3672) exists in TYPO3 versions before 4.3.4 and 4.4.x before 4.4.1. It allows an attacker to inject malicious scripts into the generated HTML textarea element, potentially leading to the execution of arbitrary code in the context of the victim's browser. This can result in various security risks, such as session hijacking, data theft, or defacement of the affected TYPO3 website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.3.44.3.4composer require typo3/cms-fluid:4.3.4 -
>= 4.4.0, < 4.4.14.4.1composer require typo3/cms-fluid:4.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, developers can manually sanitize user input before using it with the textarea view helper. This involves filtering out any potentially malicious HTML or JavaScript code. Here's an example of how to sanitize user input in PHP:
$input = $_POST['user_input'];
$sanitizedInput = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
// Use $sanitizedInput with the textarea view helper
Note that this workaround should only be used until the TYPO3 installation can be upgraded to a secure version.
Conclusion
The TYPO3 CMS-Fluid textarea view helper vulnerability (CVE-2010-3672) poses a moderate security risk to TYPO3 installations. To mitigate this vulnerability, it is crucial to upgrade to TYPO3 version 4.3.4 or 4.4.1, depending on the current version. Additionally, developers can apply a temporary workaround by sanitizing user input before using it with the textarea view helper. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-fluid →
FAQ
TYPO3 CMS-Fluid is an extbase extension for TYPO3 that provides view helpers for fluid templates. It simplifies the creation of HTML elements, including textarea elements.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as session hijacking or data theft.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your TYPO3 installation is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze the dependencies and alert you if any known vulnerabilities are found.
Yes, TYPO3 has released patches for this vulnerability. Users should upgrade to TYPO3 version 4.3.4 or 4.4.1, depending on their current version, to apply the necessary fixes.
The vulnerability allows an attacker to execute arbitrary code in the victim's browser, potentially leading to session hijacking, data theft, or defacement of the affected TYPO3 website.
