CVE-2024-25121: TYPO3 CMS-Core Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
Summary
CVE-2024-25121: TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler. Affects typo3/cms-core across 6 version ranges.
>= 8.0.0, < 8.7.57
>= 9.0.0, < 9.5.46
>= 10.0.0, < 10.4.43
>= 11.0.0, < 11.5.35
>= 12.0.0, < 12.4.11
>= 13.0.0, < 13.0.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS-Core is an open-source content management system that allows users to create and manage websites. It provides a File Abstraction Layer (FAL) for handling files and their metadata. FAL allows files to be stored in different locations and provides a fallback storage for files located outside configured file storages and within the public web root directory.
Vulnerability Detail
The vulnerability in TYPO3 CMS-Core allows entities of the File Abstraction Layer to be persisted directly via the DataHandler. This enables attackers with a valid backend user account to reference files in the fallback storage and retrieve their file names and contents. The fallback storage, also known as the "zero-storage", is a backward compatibility layer. Exploiting this vulnerability can lead to unauthorized access to sensitive files and information.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.578.7.57composer require typo3/cms-core:8.7.57 -
>= 9.0.0, < 9.5.469.5.46composer require typo3/cms-core:9.5.46 -
>= 10.0.0, < 10.4.4310.4.43composer require typo3/cms-core:10.4.43 -
>= 11.0.0, < 11.5.3511.5.35composer require typo3/cms-core:11.5.35 -
>= 12.0.0, < 12.4.1112.4.11composer require typo3/cms-core:12.4.11 -
>= 13.0.0, < 13.0.113.0.1composer require typo3/cms-core:13.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in TYPO3 CMS-Core allows unauthorized access to files in the fallback storage, potentially exposing sensitive information. It is crucial to update TYPO3 to the recommended versions and ensure strong security defaults are in place. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS-Core is an open-source content management system used for creating and managing websites.
The File Abstraction Layer (FAL) in TYPO3 is a feature that handles files and their metadata. It allows files to be stored in different locations and provides a fallback storage for files located outside configured file storages and within the public web root directory.
The vulnerability allows attackers with a valid backend user account to reference files in the fallback storage and retrieve their file names and contents. This can lead to unauthorized access to sensitive files and information.
To fix the vulnerability, it is recommended to update TYPO3 to the latest versions (8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1) that include the necessary fixes. Additionally, ensure that strong security defaults are in place and that the persistence of sys_file entities is denied by default.
No specific workaround is mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
