CVE-2020-15099: Potential Remote Code Execution in TYPO3 with mediace extension
Summary
CVE-2020-15086: Potential Remote Code Execution in TYPO3 with mediace extension. Affects friendsoftypo3/mediace versions >= 7.6.2, < 7.6.5. Fixed in 7.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that allows users to create and manage websites. The mediace extension is a TYPO3 plugin that provides media management functionality. It allows users to upload, organize, and display media files on their TYPO3 websites.
Vulnerability Detail
The mediace extension in TYPO3 has a vulnerability that allows an attacker to generate arbitrary checksums and inject arbitrary data with a valid cryptographic message authentication code (HMAC-SHA1). This vulnerability can lead to various attack chains, including potential privilege escalation and remote code execution.
The first attack chain, identified as TYPO3-CORE-SA-2020-007 (CVE-2020-15099), requires the database server used for a TYPO3 installation to be accessible to the attacker. This can be through internet access or a shared hosting network. The severity of this attack is rated as high (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C).
The second attack chain, identified as TYPO3-CORE-SA-2016-013 (CVE-2016-5091), requires the attacker to have access to at least one Extbase plugin or module action in a TYPO3 installation. This attack chain is rated as critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C).
The overall severity of this vulnerability is critical (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).
How To Fix
Minimum fixed version
7.6.5
This is the first release that contains the fix.
composer require friendsoftypo3/mediace:7.6.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The mediace extension in TYPO3 is vulnerable to potential remote code execution and privilege escalation. It is recommended to uninstall and remove the extension if not needed, or update it to version 7.6.5. Changing the encryptionKey and database credentials is also advised. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for friendsoftypo3/mediace →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites.
The mediace extension is a TYPO3 plugin that provides media management functionality, allowing users to upload, organize, and display media files on TYPO3 websites.
Privilege escalation is the act of exploiting a vulnerability to gain higher privileges or access rights than originally intended. In the context of this vulnerability, it refers to an attacker gaining elevated privileges on a TYPO3 installation.
Remote code execution is a security vulnerability that allows an attacker to execute arbitrary code on a target system or application remotely, without direct access to the system. In the context of this vulnerability, it refers to an attacker being able to execute code on a TYPO3 installation.
To update the mediace extension, you can use the TYPO3 extension manager, Packagist, or the TYPO3 extension repository to obtain the latest version (7.6.5).
