CVE-2020-11067: Insecure Deserialization in TYPO3 CMS
Summary
CVE-2020-11067: In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. Affects typo3 across 2 version ranges.
>= 9.0.0, < 9.5.16
>= 10.0.0, < 10.4.1
Fixed in 9.5.16 or 10.4.1, depending on the release line you run. How to fix ↓
Also tracked for
- typo3/cms-core · Packagist
The same CVE-2020-11067 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities, including backend user settings. These settings are stored in the $BE_USER->uc variable. However, versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1 of TYPO3 CMS are vulnerable to insecure deserialization, which can lead to remote code execution. This vulnerability requires a valid backend user account to exploit. The issue has been addressed in versions 9.5.17 and 10.4.2 of TYPO3 CMS.
Vulnerability Detail
The vulnerability in TYPO3 CMS arises from insecure deserialization of backend user settings. When combined with vulnerabilities in third-party components, this flaw can be exploited to execute arbitrary code remotely. An attacker with a valid backend user account can manipulate the serialized data to execute malicious code on the server. This can result in various consequences, such as unauthorized access, data breaches, or even complete compromise of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.5.169.5.16 -
>= 10.0.0, < 10.4.110.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a workaround, until the TYPO3 CMS update can be applied, it is advisable to restrict access to the backend user interface to trusted individuals only. This can be achieved by implementing strong authentication measures, such as multi-factor authentication, and closely monitoring user accounts for any suspicious activity.
Conclusion
In summary, TYPO3 CMS versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1 are vulnerable to insecure deserialization in backend user settings. This can be exploited by an attacker with a valid backend user account to execute arbitrary code remotely. It is crucial to update TYPO3 CMS to versions 9.5.17 or 10.4.2, apply patches, and regularly update all third-party components to mitigate the risk. For further assistance and support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for typo3 →
FAQ
TYPO3 CMS is an open-source content management system that enables users to create and manage websites.
Insecure deserialization is a vulnerability that occurs when an application deserializes untrusted data without proper validation. This can lead to the execution of arbitrary code and potentially compromise the security of the system.
An attacker with a valid backend user account can manipulate the serialized data in the backend user settings to execute arbitrary code on the server. This can result in unauthorized access, data breaches, or complete compromise of the affected system.
No, only versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1 of TYPO3 CMS are vulnerable to this insecure deserialization issue. The vulnerability has been fixed in versions 9.5.17 and 10.4.2.
If you suspect that your TYPO3 CMS installation is affected, it is recommended to update to the latest version (9.5.17 or 10.4.2) as soon as possible. Additionally, review the access controls for the backend user interface and implement strong authentication measures to minimize the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
