CVE-2020-15099: TYPO3 CMS Arbitrary File Retrieval
Summary
CVE-2020-15099: In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication cod... Affects typo3 across 2 version ranges.
>= 9.0.0, < 9.5.20
>= 10.0.0, < 10.4.6
Fixed in 9.5.20 or 10.4.6, depending on the release line you run. How to fix ↓
Also tracked for
- typo3/cms-core · Packagist
The same CVE-2020-15099 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including database management, user authentication, and content editing. However, versions greater than or equal to 9.0.0 and less than 9.5.20, as well as versions greater than or equal to 10.0.0 and less than 10.4.6, are vulnerable to an arbitrary file retrieval vulnerability.
Vulnerability Detail
The vulnerability in TYPO3 CMS allows an attacker to retrieve arbitrary files from the system. If the attacker can generate a valid cryptographic message authentication code (HMAC-SHA1), either through another existing vulnerability or by exposing the internal encryptionKey, they can access sensitive files such as typo3conf/LocalConfiguration.php. This file contains the encryptionKey and database credentials, which can be used to manipulate or delete database contents. Additionally, an attacker can create an administration user account, leading to potential remote code execution by injecting custom extensions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.209.5.20 -
>= 10.0.0, < 10.4.610.4.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update TYPO3 CMS to the patched versions as soon as possible to mitigate the risk of arbitrary file retrieval and potential database manipulation.
Conclusion
The arbitrary file retrieval vulnerability in TYPO3 CMS can lead to unauthorized access, manipulation, or deletion of database contents. It is crucial to update the CMS to the patched versions (9.5.20 or 10.4.6) to mitigate this risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3 →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites.
Versions greater than or equal to 9.0.0 and less than 9.5.20, as well as versions greater than or equal to 10.0.0 and less than 10.4.6, are affected.
By generating a valid cryptographic message authentication code (HMAC-SHA1) and accessing sensitive files, an attacker can retrieve the encryptionKey and database credentials. This allows them to manipulate or delete database contents and potentially execute remote code by injecting custom extensions.
No, there is no known workaround. It is essential to update TYPO3 CMS to the patched versions to mitigate the risk.
To update TYPO3 CMS, follow the official documentation provided by the TYPO3 community. They provide detailed instructions on how to perform the update process.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3.
