CVE-2019-19848: TYPO3 Directory Traversal on ZIP extraction
Summary
CVE-2019-19848: TYPO3 Directory Traversal on ZIP extraction. Affects typo3/cms-core across 3 version ranges.
>= 8.0.0, < 8.7.30
>= 9.0.0, < 9.5.12
>= 10.0.0, < 10.2.2
Fixed in 8.7.30, 9.5.12 or 10.2.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for creating and managing websites. It provides a wide range of features and functionalities for developers and administrators. However, a vulnerability has been discovered in TYPO3 versions before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2. This vulnerability allows for directory traversal during the extraction of manually uploaded ZIP archives in the Extension Manager. Exploiting this vulnerability requires admin privileges (or System Maintainer privileges in v9 LTS and later).
Vulnerability Detail
The vulnerability in TYPO3 allows an attacker to perform directory traversal attacks during the extraction of ZIP archives in the Extension Manager. By manipulating the file paths within the ZIP archive, an attacker can traverse outside of the intended directory and access sensitive files on the server. This can lead to unauthorized disclosure of sensitive information or even remote code execution if the attacker can upload malicious files. The vulnerability requires admin privileges to exploit, limiting the potential attackers to authorized users with elevated privileges.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.308.7.30composer require typo3/cms-core:8.7.30 -
>= 9.0.0, < 9.5.129.5.12composer require typo3/cms-core:9.5.12 -
>= 10.0.0, < 10.2.210.2.2composer require typo3/cms-core:10.2.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating TYPO3 to the latest version.
Conclusion
The vulnerability in TYPO3 versions before 8.7.30, 9.x before 9.5.12, and 10.x before 10.2.2 allows for directory traversal during the extraction of ZIP archives in the Extension Manager. This can lead to unauthorized disclosure of sensitive information or remote code execution. TYPO3 users are advised to update their installations to the latest versions to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites. It provides a wide range of features and functionalities for developers and administrators.
Directory traversal is a vulnerability that allows an attacker to access files and directories outside of the intended scope. In this case, the vulnerability allows for directory traversal during the extraction of ZIP archives in the TYPO3 Extension Manager.
The potential consequences of this vulnerability include unauthorized disclosure of sensitive information and remote code execution if the attacker can upload malicious files.
TYPO3 installations before versions 8.7.30, 9.5.12, and 10.2.2 are affected by this vulnerability. Users with admin privileges (or System Maintainer privileges in v9 LTS and later) are at risk.
To protect your TYPO3 installation, it is recommended to update to the latest version available (8.7.30 for TYPO3 8.x, 9.5.12 for TYPO3 9.x, and 10.2.2 for TYPO3 10.x). Regularly applying security updates is crucial to ensure the security of your TYPO3 installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
