TYPO3 CMS Insecure Deserialization in typo3/cms-core
Summary
GHSA-96jg-pmc4-cx39: TYPO3 CMS Insecure Deserialization. Affects typo3/cms-core across 2 version ranges.
>= 8.5.0, < 8.7.17
>= 9.0.0, < 9.3.1
Fixed in 8.7.17 or 9.3.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. The TYPO3 CMS Core package (typo3/cms-core) is a fundamental component of TYPO3 CMS, providing essential functionality for the system. However, this package is vulnerable to an Insecure Deserialization vulnerability when used in conjunction with the additional PHP PECL package 'yaml'. The 'yaml' package is capable of unserializing YAML contents to PHP objects. Exploiting this vulnerability requires a valid backend user account and the PHP setting 'yaml.decode_php' enabled, which is the default value according to PHP documentation.
Vulnerability Detail
The vulnerability arises due to the insecure deserialization of YAML contents by the 'yaml' package. An attacker with a valid backend user account can exploit this vulnerability to execute arbitrary code on the server. This can lead to various consequences, including remote code execution, data manipulation, and unauthorized access to sensitive information. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.5.0, < 8.7.178.7.17composer require typo3/cms-core:8.7.17 -
>= 9.0.0, < 9.3.19.3.1composer require typo3/cms-core:9.3.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating to a fixed version is not immediately feasible, a temporary workaround is to disable the 'yaml.decode_php' setting in the PHP configuration. This can be done by setting 'yaml.decode_php = 0' in the php.ini file. However, this workaround may impact the functionality of other applications or features that rely on the 'yaml' package.
Conclusion
The TYPO3 CMS Core package (typo3/cms-core) is vulnerable to an Insecure Deserialization vulnerability when used with the 'yaml' package. It is crucial to update to fixed versions (8.7.17 or 9.3.1) or disable the 'yaml.decode_php' setting in the PHP configuration to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system that allows users to create and manage websites.
The TYPO3 CMS Core package (typo3/cms-core) is a fundamental component of TYPO3 CMS, providing essential functionality for the system.
Insecure Deserialization is a vulnerability that occurs when an application deserializes untrusted data without proper validation. This can lead to the execution of arbitrary code and other security risks.
An attacker with a valid backend user account can exploit this vulnerability by providing malicious YAML contents that will be deserialized by the 'yaml' package. This can allow the attacker to execute arbitrary code on the server.
The impact of this vulnerability can be severe, including remote code execution, data manipulation, and unauthorized access to sensitive information.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
