CVE-2024-22188: TYPO3 CMS-Core Install Tool Code Execution Vulnerability
Summary
CVE-2024-22188: TYPO3 Install Tool vulnerable to Code Execution. Affects typo3/cms-core across 6 version ranges.
>= 8.0.0, < 8.7.57
>= 9.0.0, < 9.5.46
>= 10.0.0, < 10.4.43
>= 11.0.0, < 11.5.35
>= 12.0.0, < 12.4.11
>= 13.0.0, < 13.0.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities for building and maintaining web applications. The Install Tool is a component of TYPO3 CMS-Core that enables administrators to configure various settings, including the path to system binaries.
Vulnerability Detail
The TYPO3 CMS-Core Install Tool was found to be vulnerable to code execution. This vulnerability could be exploited by an attacker with administrator-level backend user account and system maintainer permissions. By manipulating certain settings in the Install Tool, an attacker could execute arbitrary code on the server. This could lead to unauthorized access, data breaches, and potential compromise of the entire system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.578.7.57composer require typo3/cms-core:8.7.57 -
>= 9.0.0, < 9.5.469.5.46composer require typo3/cms-core:9.5.46 -
>= 10.0.0, < 10.4.4310.4.43composer require typo3/cms-core:10.4.43 -
>= 11.0.0, < 11.5.3511.5.35composer require typo3/cms-core:11.5.35 -
>= 12.0.0, < 12.4.1112.4.11composer require typo3/cms-core:12.4.11 -
>= 13.0.0, < 13.0.113.0.1composer require typo3/cms-core:13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can enforce the known disadvantages described in TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode. This involves configuring the Install Tool to require sudo privileges for executing system binaries. By implementing this workaround, the risk of code execution can be mitigated until the system is updated to a patched version.
Conclusion
The TYPO3 CMS-Core Install Tool is vulnerable to code execution, which can be exploited by an attacker with administrator-level backend user account and system maintainer permissions. It is crucial to update TYPO3 CMS-Core to the recommended patched versions to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS-Core is an open-source content management system used for building and managing websites.
The Install Tool is a component of TYPO3 CMS-Core that allows administrators to configure various settings.
An attacker with administrator-level backend user account and system maintainer permissions can manipulate certain settings in the Install Tool to execute arbitrary code on the server.
This vulnerability could lead to unauthorized access, data breaches, and compromise of the entire system.
To fix this vulnerability, update TYPO3 CMS-Core to the recommended patched versions.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
