CVE-2017-14251: TYPO3 Arbitrary Code Execution
Summary
CVE-2017-14251: TYPO3 Arbitrary Code Execution. Affects typo3/cms across 2 version ranges.
>= 7.6.0, < 7.6.22
>= 8.0.0, < 8.7.5
Fixed in 7.6.22 or 8.7.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building websites and web applications. The vulnerability affects TYPO3 versions 7.6.0 to 7.6.21 and 8.0.0 to 8.7.4. TYPO3 allows users to upload files, but a flaw in the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php allows remote authenticated users to upload files with a .pht extension. This can lead to the execution of arbitrary PHP code.
Vulnerability Detail
The vulnerability arises due to the lack of proper file extension validation in TYPO3. An attacker with authenticated access can upload a file with a .pht extension, which is not properly restricted by the fileDenyPattern. This allows the attacker to execute arbitrary PHP code on the server. The impact of this vulnerability can be severe, as it enables remote code execution, potentially leading to unauthorized access, data breaches, and system compromise.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.6.0, < 7.6.227.6.22composer require typo3/cms:7.6.22 -
>= 8.0.0, < 8.7.58.7.5composer require typo3/cms:8.7.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading TYPO3 is not immediately possible, a temporary workaround is to modify the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php to disallow the .pht extension. The following code snippet demonstrates the modification:
$fileDenyPattern = '/\.(php[3-7]?|phtml|phar|pht)(\..*)?$/i';
By adding '|pht' to the pattern, the .pht extension will be denied during file uploads.
Conclusion
The vulnerability in TYPO3 allows remote authenticated users to upload files with a .pht extension and execute arbitrary PHP code. It is crucial to upgrade TYPO3 to the recommended versions or apply the workaround to mitigate the risk. Keeping the CMS up to date is essential for maintaining the security of the system. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) used for building websites and web applications. It is written in PHP and has a large user and developer community.
The vulnerability allows remote authenticated users to upload files with a .pht extension and execute arbitrary PHP code. This can lead to unauthorized access, data breaches, and system compromise.
To fix this vulnerability, it is recommended to upgrade TYPO3 to the latest version that includes the fix. For versions 7.6.x, upgrade to version 7.6.22 or higher. For versions 8.x, upgrade to version 8.7.5 or higher.
If immediate upgrade is not possible, a temporary workaround is to modify the fileDenyPattern in sysext/core/Classes/Core/SystemEnvironmentBuilder.php to disallow the .pht extension during file uploads.
You can find more information about this vulnerability, including the affected versions and fix details, in the TYPO3 security advisory: [link to advisory]
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
