Configuration Injection in Direct Mail extension (direct_mail)
Summary
CVE-2023-50461: Configuration Injection in extension "Direct Mail" (direct_mail). Affects directmailteam/direct-mail across 3 version ranges.
< 6.0.3
>= 7.0.0, < 7.0.3
>= 8.0.0, < 9.5.2
Fixed in 6.0.3, 7.0.3 or 9.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Direct Mail extension is a package for TYPO3, a popular content management system. It provides functionality for managing and sending newsletters and email campaigns. The extension allows users to configure various settings related to email delivery and content. However, a vulnerability has been discovered in the extension that allows an authenticated user to inject arbitrary configuration code, leading to potential code execution and security breaches.
Vulnerability Detail
The vulnerability exists in the 'Configuration' backend module of the Direct Mail extension. An authenticated user with access to this module can write arbitrary page TSConfig for folders configured as 'Direct Mail'. This allows the user to inject malicious code into the configuration, potentially leading to Configuration Injection in TYPO3 versions 10.4 and above, and Arbitrary Code Execution in TYPO3 versions 9.5 and below. Exploiting this vulnerability can have severe consequences, including unauthorized access, data breaches, and remote code execution.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 6.0.36.0.3composer require directmailteam/direct-mail:6.0.3 -
>= 7.0.0, < 7.0.37.0.3composer require directmailteam/direct-mail:7.0.3 -
>= 8.0.0, < 9.5.29.5.2composer require directmailteam/direct-mail:9.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is advised to restrict access to the 'Configuration' backend module for users who do not require it. This can be done by adjusting the user roles and permissions within the TYPO3 backend. By limiting access to this module, the risk of exploitation can be mitigated.
Conclusion
The Configuration Injection vulnerability in the Direct Mail extension for TYPO3 poses a significant risk to the security and integrity of affected applications. It allows an authenticated user to inject arbitrary code, potentially leading to unauthorized access, data breaches, and remote code execution. It is crucial to update the extension to the recommended versions and review existing configurations for potential injection. Restricting access to the 'Configuration' backend module can serve as a temporary workaround. Regularly monitoring for updates and applying them promptly is essential to maintain the security of the application. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for directmailteam/direct-mail →
FAQ
The vulnerability allows an authenticated user to inject arbitrary code, potentially leading to unauthorized access, data breaches, and remote code execution. It poses a significant risk to the security and integrity of the TYPO3 application.
Users of the Direct Mail extension for TYPO3 versions 6.0.3 and below, 7.0.3 and below, and 9.5.2 and below are affected by this vulnerability. TYPO3 versions 10.4 and above are also vulnerable.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file to the playground, and it will analyze and alert you if any open-source vulnerabilities, including this one, are detected.
At the time of this advisory, there are no known public exploits specifically targeting this vulnerability. However, it is crucial to apply the recommended fixes and stay updated to mitigate any potential risks.
For further support and assistance in remediating this vulnerability, you can reach out to info@devnack.com. Our team of experts will be happy to assist you in securing your TYPO3 application.
References
Related vulnerabilities
Recent vulnerabilities recorded for directmailteam/direct-mail.
