CVE-2019-16699: RCE Vulnerability in sr_freecap for Typo3
Summary
CVE-2019-16699: sr_freecap for Typo3 RCE Vulnerability. Affects sjbr/sr-freecap across 2 version ranges.
< 2.4.6
>= 2.5.0, < 2.5.3
Fixed in 2.4.6 or 2.5.3, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The sr_freecap extension is a CAPTCHA solution for TYPO3 websites. It provides a way to protect forms from automated submissions by generating and validating CAPTCHA images. The extension is widely used and helps TYPO3 website owners prevent spam and abuse. However, versions 2.4.5 and below, as well as 2.5.2 and below, of the sr_freecap extension have a critical vulnerability that allows remote code execution (RCE).
Vulnerability Detail
The vulnerability in sr_freecap for Typo3 arises from a failure to properly sanitize user input. This allows an attacker to execute arbitrary Extbase actions, leading to remote code execution. An attacker can exploit this vulnerability by submitting specially crafted input to the affected TYPO3 website. The consequences of successful exploitation can be severe, as it grants the attacker full control over the affected system, enabling them to execute arbitrary commands, access sensitive data, or disrupt the normal operation of the website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.4.62.4.6composer require sjbr/sr-freecap:2.4.6 -
>= 2.5.0, < 2.5.32.5.3composer require sjbr/sr-freecap:2.5.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the sr_freecap extension to a patched version as soon as possible.
Conclusion
The sr_freecap extension for Typo3 versions 2.4.5 and below, as well as 2.5.2 and below, is vulnerable to remote code execution. Website owners should update the extension to a patched version (2.4.6 or above for version 2.4.5, and 2.5.3 or above for version 2.5.2) to mitigate the risk. Failure to address this vulnerability can result in unauthorized access, data breaches, or disruption of the affected TYPO3 website. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for sjbr/sr-freecap →
FAQ
The vulnerability allows an attacker to execute arbitrary code on the affected TYPO3 website, potentially leading to complete compromise of the system.
Yes, this vulnerability can be exploited remotely. An attacker can submit specially crafted input to the affected TYPO3 website to trigger the vulnerability.
No, only versions 2.4.5 and below, as well as 2.5.2 and below, are affected. Website owners should check their installed version and update if necessary.
At the time of this advisory, there is no known public exploit for this vulnerability. However, it is crucial to update the extension to a patched version to mitigate the risk.
You can find more information about this vulnerability in the official GitHub advisory: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-598p-rv6p-g7qc/GHSA-598p-rv6p-g7qc.json
Related vulnerabilities
Recent vulnerabilities recorded for sjbr/sr-freecap.
