CVE-2024-25119: TYPO3 CMS-Core Install Tool Information Disclosure of Encryption Key
Summary
CVE-2024-25119: TYPO3 Install Tool vulnerable to Information Disclosure of Encryption Key. Affects typo3/cms-core across 6 version ranges.
>= 8.0.0, < 8.7.57
>= 9.0.0, < 9.5.46
>= 10.0.0, < 10.4.43
>= 11.0.0, < 11.5.35
>= 12.0.0, < 12.4.11
>= 13.0.0, < 13.0.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Core is an open-source content management system used for building and managing websites. It provides a wide range of features and functionalities for website administrators and developers. The TYPO3 Install Tool is a web-based interface that allows administrators to configure and maintain their TYPO3 installations. It provides various settings and options for managing the CMS. However, a vulnerability in the Install Tool allows for the disclosure of the encryption key used for cryptographic hashes.
Vulnerability Detail
The TYPO3 Install Tool user interface displayed the plaintext value of the encryption key, $GLOBALS['SYS']['encryptionKey'], in the editing forms. This exposed the encryption key to potential attackers who could utilize it to generate cryptographic hashes for verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions. The impact of this vulnerability could lead to unauthorized access, data tampering, and other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.578.7.57composer require typo3/cms-core:8.7.57 -
>= 9.0.0, < 9.5.469.5.46composer require typo3/cms-core:9.5.46 -
>= 10.0.0, < 10.4.4310.4.43composer require typo3/cms-core:10.4.43 -
>= 11.0.0, < 11.5.3511.5.35composer require typo3/cms-core:11.5.35 -
>= 12.0.0, < 12.4.1112.4.11composer require typo3/cms-core:12.4.11 -
>= 13.0.0, < 13.0.113.0.1composer require typo3/cms-core:13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. It is advised to update to the fixed versions as soon as possible.
Conclusion
The TYPO3 CMS-Core Install Tool vulnerability allows for the disclosure of the encryption key used for cryptographic hashes. It is crucial to update to the fixed versions to mitigate the risk of unauthorized access and data tampering. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS-Core is an open-source content management system used for building and managing websites. It provides a wide range of features and functionalities for website administrators and developers.
The TYPO3 Install Tool is a web-based interface that allows administrators to configure and maintain their TYPO3 installations. It provides various settings and options for managing the CMS.
The vulnerability allows for the disclosure of the encryption key used for cryptographic hashes. This could lead to unauthorized access, data tampering, and other security breaches.
Exploiting this vulnerability requires an administrator-level backend user account with system maintainer permissions.
To fix this vulnerability, update to the latest TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
