CVE-2014-8327: fal_sftp Extension for TYPO3 Exposes Sensitive Information Due to Weak Permissions
Summary
CVE-2014-8327: fal_sftp extension for TYPO3 uses weak permissions for sFTP driver files and folders. Affects co-stack/fal_sftp versions < 0.2.6. Fixed in 0.2.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The fal_sftp extension is a component used in TYPO3, a popular open-source content management system. This extension facilitates secure file transfer protocol (sFTP) operations, allowing users to manage files securely over the internet. However, prior to version 0.2.6, the extension implemented weak permissions for its driver files and folders, making it susceptible to unauthorized access by remote authenticated users.
Vulnerability Detail
The vulnerability arises from the fal_sftp extension's use of weak file and folder permissions, which can be exploited by remote authenticated users to gain access to sensitive information. This could lead to data breaches or unauthorized manipulation of files, posing a significant risk to the integrity and confidentiality of the data managed by TYPO3. The issue is classified under CWE-276, which pertains to incorrect assignment of permissions.
How To Fix
Minimum fixed version
0.2.6
This is the first release that contains the fix.
composer require co-stack/fal_sftp:0.2.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can manually adjust the permissions of the fal_sftp driver files and folders to restrict access. Ensure that only authorized users have the necessary permissions to access these files. For example, you can use the following command to set stricter permissions: 'chmod 700 /path/to/fal_sftp/directory'.
Conclusion
The fal_sftp extension for TYPO3 has a critical vulnerability due to weak permissions that can expose sensitive information to unauthorized users. It is crucial to update to version 0.2.6 or later to mitigate this risk. Additionally, temporary workarounds can be implemented to enhance security until the update is applied.
See every vulnerability recorded for co-stack/fal_sftp →
FAQ
The fal_sftp extension is a TYPO3 component that enables secure file transfers using the sFTP protocol, allowing users to manage files securely.
The risks include unauthorized access to sensitive information, potential data breaches, and manipulation of files by remote authenticated users.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider adjusting file permissions as a temporary workaround to mitigate the risk.
More information about the fal_sftp extension can be found on its official repository on Packagist or TYPO3's documentation.
