CVE-2023-24814: TYPO3 CMS Core - Cross-Site Scripting via Frontend Rendering
Summary
CVE-2023-24814: TYPO3 is vulnerable to Cross-Site Scripting via frontend rendering. Affects typo3/cms-core across 5 version ranges.
>= 8.7.0, < 8.7.51
>= 9.0.0, < 9.5.40
>= 10.0.0, < 10.4.36
>= 11.0.0, < 11.5.23
>= 12.0.0, < 12.2.0
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- typo3 · Bitnami
The same CVE-2023-24814 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities for website development, including frontend rendering. However, a vulnerability has been discovered in TYPO3 CMS Core that allows for Cross-Site Scripting (XSS) attacks via frontend rendering.
Vulnerability Detail
The vulnerability in TYPO3 CMS Core arises from the usage of the unfiltered server environment variable PATH_INFO in the GeneralUtility::getIndpEnv() function. This allows attackers to inject malicious content, which can be further exploited when combined with the TypoScript setting config.absRefPrefix=auto. Attackers can inject malicious HTML code into pages that have not yet been rendered and cached, resulting in the injection being cached and delivered to other website visitors. This leads to a persistent cross-site scripting vulnerability. The vulnerability affects TYPO3 versions 8.7 and 9.x if the server environment variable TYPO3_PATH_ROOT is defined, which is the case for installations via Composer. Apache and Microsoft IIS web servers using PHP-CGI (FPM, FCGI/FastCGI, or similar) are confirmed to be affected, with a potential risk for nginx as well.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 8.7.0, < 8.7.518.7.51composer require typo3/cms-core:8.7.51 -
>= 9.0.0, < 9.5.409.5.40composer require typo3/cms-core:9.5.40 -
>= 10.0.0, < 10.4.3610.4.36composer require typo3/cms-core:10.4.36 -
>= 11.0.0, < 11.5.2311.5.23composer require typo3/cms-core:11.5.23 -
>= 12.0.0, < 12.2.012.2.0composer require typo3/cms-core:12.2.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A possible workaround for websites that cannot be patched immediately is to set the TypoScript setting config.absRefPrefix to a static path value, such as config.absRefPrefix=/. However, it is important to note that this workaround does not fully address all aspects of the vulnerability and is only considered an intermediate mitigation for the most prominent manifestation.
Conclusion
The vulnerability in TYPO3 CMS Core allows for Cross-Site Scripting (XSS) attacks via frontend rendering. It is crucial to update to the latest TYPO3 versions that fix the vulnerability and follow the recommended steps to ensure the security of your TYPO3 installation. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system that allows users to create and manage websites. It provides a wide range of features and functionalities for website development.
Cross-Site Scripting (XSS) is a type of security vulnerability that allows attackers to inject malicious scripts into web pages viewed by other users. This can lead to various attacks, such as stealing sensitive information or performing actions on behalf of the user.
The vulnerability in TYPO3 CMS Core arises from the usage of the unfiltered server environment variable PATH_INFO in the GeneralUtility::getIndpEnv() function. This allows attackers to inject malicious content, which can be further exploited when combined with the TypoScript setting config.absRefPrefix=auto.
The vulnerability affects TYPO3 versions 8.7 and 9.x if the server environment variable TYPO3_PATH_ROOT is defined, which is the case for installations via Composer. Additionally, Apache and Microsoft IIS web servers using PHP-CGI (FPM, FCGI/FastCGI, or similar) are confirmed to be affected.
To mitigate the vulnerability, it is recommended to update to the latest TYPO3 versions that address the issue. Additionally, web servers using PHP-CGI need to ensure that the PHP setting cgi.fix_pathinfo=1 is enabled. If immediate patching is not possible, setting the TypoScript setting config.absRefPrefix to a static path value can provide an intermediate mitigation.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
