Session Hijacking Risk in TYPO3 CMS Due to Cookie Misconfiguration
Summary
GHSA-f777-f784-36gm: TYPO3 Security Misconfiguration in Install Tool Cookie. Affects typo3/cms across 3 version ranges.
>= 7.0.0, < 7.6.32
>= 8.0.0, < 8.7.21
>= 9.0.0, < 9.5.2
Fixed in 7.6.32, 8.7.21 or 9.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is a popular open-source content management system that enables users to create and manage websites efficiently. It offers a wide range of features, including templating, user management, and extensibility through plugins. However, a security misconfiguration in its Install Tool has been identified, which can expose users to session hijacking attacks if not addressed promptly.
Vulnerability Detail
The vulnerability arises from the cookies created in the TYPO3 Install Tool not being hardened to be submitted only via HTTP. This misconfiguration can be exploited in conjunction with other vulnerabilities, such as cross-site scripting (XSS), allowing an attacker to hijack an active and valid session in the Install Tool. This can lead to unauthorized access to sensitive administrative functions, potentially compromising the entire TYPO3 installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.6.327.6.32composer require typo3/cms:7.6.32 -
>= 8.0.0, < 8.7.218.7.21composer require typo3/cms:8.7.21 -
>= 9.0.0, < 9.5.29.5.2composer require typo3/cms:9.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, consider implementing additional security measures such as setting the 'Secure' and 'HttpOnly' flags on cookies, which can help reduce the risk of session hijacking. This can be done by modifying the cookie settings in your TYPO3 configuration.
Conclusion
The TYPO3 CMS vulnerability related to cookie misconfiguration poses a significant risk of session hijacking. It is crucial for users to update to the latest patched versions to protect their installations. Implementing additional security measures can also help mitigate risks until the update is applied.
See every vulnerability recorded for typo3/cms →
FAQ
The CVSS score for this vulnerability is 8.1, indicating a high severity level that requires immediate attention.
The vulnerability affects TYPO3 versions 7.0.0 to 7.6.31, 8.0.0 to 8.7.20, and 9.0.0 to 9.5.1.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If exploited, this vulnerability can lead to unauthorized access to the TYPO3 Install Tool, allowing attackers to manipulate site settings and data.
Yes, Vulert provides real-time monitoring and alerts for open-source vulnerabilities using just the composer.lock file, ensuring you stay informed about potential risks.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
