TYPO3 Cross-Site Scripting in Filelist Module
Summary
GHSA-6xwf-7rfm-4gwc: TYPO3 Cross-Site Scripting in Filelist Module. Affects typo3/cms-core across 3 version ranges.
>= 8.0.0, < 8.7.30
>= 9.0.0, < 9.5.12
>= 10.0.0, < 10.2.1
Fixed in 8.7.30, 9.5.12 or 10.2.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) used for building and managing websites. The TYPO3 CMS Core package is responsible for the core functionality of TYPO3. It provides features such as file management through the Filelist module. This module allows users to view and manage files on the server. However, a vulnerability has been discovered in the Filelist module that allows for cross-site scripting (XSS) attacks when a file extension contains malicious sequences. Exploiting this vulnerability requires access to the file system of the server, either directly or through synchronization.
Vulnerability Detail
The vulnerability in the Filelist module of TYPO3 CMS Core arises from inadequate input sanitization. When a file extension contains malicious sequences, the output table listing in the Files backend module becomes vulnerable to XSS attacks. An attacker can craft a file with a malicious extension and upload it to the server. When the Filelist module generates the table listing, the malicious code within the file extension gets executed in the context of the user viewing the table. This can lead to various consequences, such as unauthorized access, data theft, or the execution of arbitrary code.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.0.0, < 8.7.308.7.30composer require typo3/cms-core:8.7.30 -
>= 9.0.0, < 9.5.129.5.12composer require typo3/cms-core:9.5.12 -
>= 10.0.0, < 10.2.110.2.1composer require typo3/cms-core:10.2.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict file uploads to only allow files with safe extensions. This can be achieved by configuring the server or the Filelist module to reject files with potentially dangerous extensions. However, this workaround is not foolproof and should be considered a temporary measure until the system is updated to a patched version.
Conclusion
The TYPO3 CMS Core package is vulnerable to cross-site scripting (XSS) attacks in the Filelist module. It is crucial to update to the latest patched version of TYPO3 CMS Core (8.7.30, 9.5.12, or 10.2.1) to mitigate this vulnerability. Administrators should also ensure that all uploaded files are properly validated and sanitized to prevent the execution of malicious code. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS Core is the central package that provides the core functionality of the TYPO3 content management system. It includes features such as user management, page rendering, and file management.
The Filelist module in TYPO3 CMS Core allows users to view and manage files on the server. It generates a table listing of files and provides options for file operations such as deletion, renaming, and moving.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to unauthorized access, data theft, or the execution of arbitrary code.
To exploit this vulnerability, an attacker needs access to the file system of the server, either directly or through synchronization. They can craft a file with a malicious extension and upload it to the server. When the Filelist module generates the table listing, the malicious code within the file extension gets executed in the context of the user viewing the table.
The consequences of this vulnerability can vary depending on the attacker's intentions. They can include unauthorized access to sensitive information, data theft, defacement of the website, or the execution of arbitrary code on the server.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
