TYPO3 Frontend Unauthenticated Path Disclosure
Summary
GHSA-pqfv-97hj-g97g: TYPO3 Frontend vulnerable to Unauthenticated Path Disclosure. Affects typo3/cms across 2 version ranges.
>= 6.2.0, < 6.2.15
>= 7.0.0, < 7.4.0
Fixed in 6.2.15 or 7.4.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) written in PHP. It is widely used for building and managing websites. The TYPO3 CMS package, available on Packagist, is a popular choice for developers. However, a vulnerability has been discovered in the TYPO3 Frontend component that allows unauthenticated users to disclose the absolute server path to the TYPO3 installation.
Vulnerability Detail
The vulnerability arises when a PHP script, included with TYPO3 for testing purposes, is called. This script inadvertently exposes the absolute server path to the TYPO3 installation. This information can be leveraged by attackers to gain insights into the server's file structure and potentially plan further attacks. The vulnerability affects TYPO3 versions 6.2.0 to 6.2.15 and versions 7.0.0 to 7.4.0.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 6.2.0, < 6.2.156.2.15composer require typo3/cms:6.2.15 -
>= 7.0.0, < 7.4.07.4.0composer require typo3/cms:7.4.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can manually remove or disable the vulnerable PHP script from their TYPO3 installations. The script in question is located at [TYPO3 installation path]/typo3/sysext/core/Tests/Functional/Frontend/PathDisclosureScript.php. By deleting or renaming this file, the path disclosure vulnerability can be mitigated.
Conclusion
The TYPO3 Frontend Unauthenticated Path Disclosure vulnerability exposes the absolute server path to the TYPO3 installation, potentially aiding attackers in planning further attacks. TYPO3 users are advised to upgrade their installations to the latest available version or apply the temporary workaround of removing the vulnerable PHP script. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
TYPO3 is an open-source content management system (CMS) used for building and managing websites. It is written in PHP and offers a wide range of features and extensions.
The vulnerability allows unauthenticated users to obtain the absolute server path to the TYPO3 installation. This information can be used by attackers to gain insights into the server's file structure and potentially plan further attacks.
The vulnerability affects TYPO3 versions 6.2.0 to 6.2.15 and versions 7.0.0 to 7.4.0.
To fix this vulnerability, TYPO3 users should upgrade their installations to the latest available version. For TYPO3 versions 6.2.0 to 6.2.15, upgrading to version 6.2.16 or higher is recommended. For TYPO3 versions 7.0.0 to 7.4.0, upgrading to version 7.4.1 or higher is advised.
Yes, as a temporary workaround, users can manually remove or disable the vulnerable PHP script located at [TYPO3 installation path]/typo3/sysext/core/Tests/Functional/Frontend/PathDisclosureScript.php.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
