CVE-2015-5956: TYPO3 CMS Cross-Site Scripting (XSS)
Summary
CVE-2015-5956: TYPO3 cross-site scripting (XSS). Affects typo3/cms across 3 version ranges.
>= 4.0, <= 4.5.40
>= 6.0, < 6.2.15
>= 7.0, < 7.4.0
Fixed in 6.2.15 or 7.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including customizable templates, multi-language support, and extensibility through plugins. However, versions prior to 6.2.15, 7.4.0, and 4.5.40 are vulnerable to a cross-site scripting (XSS) attack.
Vulnerability Detail
The vulnerability in TYPO3 CMS allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting attacks. This can be achieved by exploiting the sanitizeLocalUrl function, which fails to properly handle base64 encoded data URIs. An attacker can exploit this vulnerability by injecting malicious code into the returnUrl parameter of the show_rechis.php script or the redirect_url parameter of the index.php script. This can lead to the execution of arbitrary JavaScript code in the context of the affected website, potentially compromising user data and enabling further attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.0, < 6.2.156.2.15composer require typo3/cms:6.2.15 -
>= 7.0, < 7.4.07.4.0composer require typo3/cms:7.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to a patched version is not immediately possible, a temporary workaround can be implemented by manually sanitizing user input before using it in the affected scripts. This can be done by implementing proper input validation and output encoding techniques to prevent the execution of malicious code. Here is an example of how to sanitize the returnUrl parameter in PHP:
$returnUrl = filter_var($_GET['returnUrl'], FILTER_SANITIZE_URL);
Conclusion
The vulnerability in TYPO3 CMS versions prior to 6.2.15, 7.4.0, and 4.5.40 allows for cross-site scripting attacks, potentially compromising user data and enabling further exploitation. It is recommended to upgrade to the latest patched version of TYPO3 CMS to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, making it a popular choice for web development.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to the execution of arbitrary code in the context of the affected website, potentially compromising user data and enabling further attacks.
The vulnerability in TYPO3 CMS allows remote authenticated users to bypass the XSS filter and conduct cross-site scripting attacks. By exploiting the sanitizeLocalUrl function, an attacker can inject malicious code into specific parameters, leading to the execution of arbitrary JavaScript code in the context of the affected website.
The consequences of this vulnerability can vary depending on the attacker's intentions. However, in general, it can lead to the theft of sensitive user information, session hijacking, defacement of the affected website, and the propagation of malware or phishing attacks.
To protect your TYPO3 CMS installation from this vulnerability, it is crucial to keep the software up to date by applying the latest security patches. Regularly check for updates and follow best practices for secure coding, such as input validation and output encoding, to mitigate the risk of XSS attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
