TYPO3 Cross-Site Scripting in legacy form component
Summary
GHSA-vgm8-r9gm-fw59: TYPO3 Cross-Site Scripting in legacy form component. Affects typo3/cms versions >= 6.2.0, < 6.2.18. Fixed in 6.2.18. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is a popular content management system (CMS) that allows users to create and manage websites. The legacy form component in TYPO3 is responsible for handling form submissions. It provides functionality for creating and managing form content elements. However, this component is vulnerable to Cross-Site Scripting (XSS) attacks. XSS occurs when user-supplied data is not properly sanitized and is rendered as HTML on the page. This allows an attacker to inject malicious scripts into the page, potentially leading to unauthorized access or data theft.
Vulnerability Detail
The vulnerability in the legacy form component of TYPO3 arises from a failure to properly sanitize content from editors. This means that if an editor with access to a form content element includes malicious code, it will not be filtered or escaped before being rendered on the page. As a result, an attacker with a valid editor account can exploit this vulnerability by injecting malicious scripts into the form content, which will then be executed by unsuspecting users visiting the page. The impact of this vulnerability can range from defacement of the website to stealing sensitive user information.
How To Fix
Minimum fixed version
6.2.18
This is the first release that contains the fix.
composer require typo3/cms:6.2.18Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version of TYPO3 is not immediately feasible, a temporary workaround is to disable the legacy form component or restrict access to it. This can be done by modifying the configuration settings or permissions of the TYPO3 installation. By disabling or limiting access to the vulnerable component, the risk of exploitation can be reduced. However, it is strongly recommended to apply the official patch by upgrading to the latest version as soon as possible.
Conclusion
The TYPO3 legacy form component is vulnerable to Cross-Site Scripting (XSS) attacks due to a lack of proper content sanitization. This can allow attackers to inject malicious scripts into form content elements, potentially leading to unauthorized access or data theft. To mitigate this vulnerability, it is crucial to update TYPO3 to version 6.2.18 or later. In the meantime, disabling or restricting access to the vulnerable component can provide temporary protection. For further assistance or support in addressing this vulnerability, please contact DevNack.com.
See every vulnerability recorded for typo3/cms →
FAQ
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. These scripts can be used to steal sensitive information, perform unauthorized actions, or deface websites.
Any TYPO3 installation using a version prior to 6.2.18 is potentially affected by this vulnerability. Specifically, websites that have editors with access to the legacy form component are at risk.
An attacker exploiting this vulnerability can inject malicious scripts into form content elements. When unsuspecting users visit the affected page and interact with the form, the injected scripts will be executed in their browsers. This can lead to various consequences, such as stealing user credentials, spreading malware, or defacing the website.
Yes, the TYPO3 development team has released a patch in version 6.2.18. By upgrading to this version or any subsequent version, the vulnerability will be fixed.
At the time of this report, there have been no publicly disclosed instances of this vulnerability being actively exploited. However, it is important to apply the patch as soon as possible to prevent potential attacks.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
