CVE-2010-4962: Webkit PDFs Extension for TYPO3 Vulnerability Allows Remote Command Execution
Summary
CVE-2010-4962: Webkit PDFs for TYPO3 allows remote attackers to execute arbitrary commands. Affects dmk/webkitpdf versions < 1.1.4. Fixed in 1.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Webkit PDFs extension (webkitpdf) for TYPO3 is designed to facilitate the generation of PDF documents using WebKit rendering. This extension is widely used in TYPO3 applications to enhance document handling capabilities. However, prior to version 1.1.4, it contains a critical vulnerability that exposes users to potential remote command execution attacks, compromising the security of the application.
Vulnerability Detail
The vulnerability in the Webkit PDFs extension arises from unspecified vectors that allow remote attackers to execute arbitrary commands on the server. This could lead to unauthorized access, data breaches, or complete system compromise. The issue is classified under CWE-94, which pertains to code injection vulnerabilities, highlighting the severity of the risk posed by this flaw.
How To Fix
Minimum fixed version
1.1.4
This is the first release that contains the fix.
composer require dmk/webkitpdf:1.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate updating is not feasible, consider disabling the Webkit PDFs extension temporarily until the update can be applied. This can be done by commenting out or removing the extension from your TYPO3 configuration.
Conclusion
The Webkit PDFs extension for TYPO3 has a critical vulnerability that allows remote command execution, posing significant risks to applications using it. Updating to version 1.1.4 or later is crucial for maintaining security. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for dmk/webkitpdf →
FAQ
The vulnerability allows remote attackers to execute arbitrary commands on the server through the Webkit PDFs extension.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
Exploitation of this vulnerability could lead to unauthorized access, data loss, or complete system control by attackers.
Yes, the vulnerability is patched in version 1.1.4 of the Webkit PDFs extension. Updating to this version will mitigate the risk.
If you cannot update the extension right away, consider disabling it temporarily to prevent potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for dmk/webkitpdf.
