Cross-Site Scripting Vulnerability in TYPO3 CMS - Link Handling
Summary
GHSA-xgmx-j3hv-jh9x: TYPO3 Cross-Site Scripting in Link Handling. Affects typo3/cms across 3 version ranges.
>= 8.0.0, < 8.7.30
>= 9.0.0, < 9.5.12
>= 10.0.0, < 10.2.1
Fixed in 8.7.30, 9.5.12 or 10.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is a widely used open-source content management system that enables users to create and manage websites efficiently. It offers a robust set of features, including templating, user management, and extensibility through plugins. However, a vulnerability has been identified in its link handling functionality, specifically related to the processing of t3:// URLs, which can lead to cross-site scripting (XSS) attacks.
Vulnerability Detail
The vulnerability arises from improper handling of t3:// URLs within TYPO3's typolink functionality, which can be exploited to inject malicious scripts into web pages. This can affect both backend forms and frontend extensions that utilize typolink rendering. If exploited, an attacker could execute arbitrary JavaScript in the context of the user's browser, potentially leading to data theft, session hijacking, or other malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.308.7.30composer require typo3/cms:8.7.30 -
>= 9.0.0, < 9.5.129.5.12composer require typo3/cms:9.5.12 -
>= 10.0.0, < 10.2.110.2.1composer require typo3/cms:10.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, users can sanitize user inputs and validate URLs before processing them with typolink. This can help mitigate the risk of XSS attacks until the package is updated. Implementing a custom validation function to check for valid URL formats can be beneficial.
Conclusion
The identified cross-site scripting vulnerability in TYPO3 CMS's link handling poses a significant risk to users. It is crucial to update to the latest patched versions to mitigate this risk effectively. Additionally, employing input validation can serve as a temporary safeguard until the update is applied.
See every vulnerability recorded for typo3/cms →
FAQ
The vulnerability is a cross-site scripting (XSS) issue in TYPO3's link handling, allowing attackers to inject malicious scripts.
Versions 8.0.0 to 8.7.30, 9.0.0 to 9.5.12, and 10.0.0 to 10.2.1 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score for this vulnerability is 6.1, indicating a moderate severity level.
If immediate updating is not possible, implement input validation and sanitization as a temporary measure to reduce the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms.
