CVE-2010-5099: TYPO3 Path Traversal Vulnerability in TYPO3 CMS
Summary
CVE-2010-5099: TYPO3 Path Traversal vulnerability. Affects typo3/cms across 3 version ranges.
>= 4.2.0, < 4.2.16
>= 4.3.0, < 4.3.9
>= 4.4.0, < 4.4.5
Fixed in 4.2.16, 4.3.9 or 4.4.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. It offers a robust framework for developers and a user-friendly interface for content editors. However, certain versions of TYPO3 have been found to be vulnerable to a path traversal attack, which can lead to unauthorized access to sensitive files within the system.
Vulnerability Detail
The vulnerability arises from the fileDenyPattern functionality in the PHP file inclusion protection API of TYPO3 versions 4.2.x before 4.2.16, 4.3.x before 4.3.9, and 4.4.x before 4.4.5. This functionality fails to adequately filter file types, allowing remote attackers to bypass access restrictions. By exploiting path traversal sequences, including the use of %00 null bytes, attackers can access arbitrary PHP files, potentially exposing sensitive information such as the TYPO3 encryption key stored in localconf.php.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.2.0, < 4.2.164.2.16composer require typo3/cms:4.2.16 -
>= 4.3.0, < 4.3.94.3.9composer require typo3/cms:4.3.9 -
>= 4.4.0, < 4.4.54.4.5composer require typo3/cms:4.4.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional file access controls at the server level to restrict access to sensitive files. This can be done by configuring the web server to deny access to specific directories or files that should not be publicly accessible.
Conclusion
The TYPO3 path traversal vulnerability (CVE-2010-5099) poses a significant risk to installations of TYPO3 CMS versions prior to the patched releases. It is crucial for users to update their systems to the latest versions to protect against potential attacks. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for typo3/cms →
FAQ
A path traversal vulnerability allows an attacker to access files and directories that are stored outside the intended directory structure, potentially exposing sensitive information.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By uploading your composer.lock file, you can check if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to sensitive files, including configuration files that may contain encryption keys or other critical information.
While updating is the best solution, implementing server-level access controls can help mitigate the risk temporarily until the update can be performed.
Detailed information can be found in the official advisory on GitHub and other security databases that track vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
