Unrestricted File Upload Vulnerability in TYPO3 Powermail Extension
Summary
CVE-2014-3947: TYPO3 powermail extension has unrestricted file upload vulnerability. Affects in2code/powermail across 2 version ranges.
< 1.6.11
>= 2.0.0, < 2.0.14
Fixed in 1.6.11 or 2.0.14, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TYPO3 Powermail extension is a popular tool used for creating and managing forms within TYPO3 websites. It allows users to easily build forms, manage submissions, and customize the user experience. However, prior versions of this extension are vulnerable to an unrestricted file upload issue, which can lead to severe security risks if exploited.
Vulnerability Detail
The unrestricted file upload vulnerability in the Powermail extension, affecting versions before 1.6.11 and 2.x before 2.0.14, allows remote attackers to upload files with malicious extensions. This can lead to arbitrary code execution on the server, compromising the integrity and security of the affected TYPO3 installation. Attackers can exploit this vulnerability through unspecified vectors, making it critical for users to address it promptly.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.6.111.6.11composer require in2code/powermail:1.6.11 -
>= 2.0.0, < 2.0.142.0.14composer require in2code/powermail:2.0.14
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can restrict file uploads by implementing server-side validation to check file types and extensions before processing uploads. This can be done by adding validation rules in the form processing logic to ensure only safe file types are accepted.
Conclusion
The unrestricted file upload vulnerability in the TYPO3 Powermail extension poses significant security risks, allowing attackers to execute arbitrary code. Users are urged to update to the latest patched versions to mitigate these risks. Regular monitoring and updates are essential for maintaining the security of TYPO3 applications.
See every vulnerability recorded for in2code/powermail →
FAQ
The TYPO3 Powermail extension is a tool for creating and managing forms on TYPO3 websites, allowing users to customize forms and handle submissions efficiently.
It means that an attacker can upload files without proper restrictions, potentially allowing them to execute harmful code on the server.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The primary risk is arbitrary code execution, which can lead to data breaches, server compromise, and loss of control over the affected system.
It is recommended to regularly check for updates and apply them promptly to ensure your TYPO3 installation remains secure against known vulnerabilities.
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
