Insecure Deserialization Vulnerability in typo3/phar-stream-wrapper
Summary
GHSA-4v5g-8pq2-32m2: By-passing Protection of PharStreamWrapper Interceptor. Affects typo3/phar-stream-wrapper across 2 version ranges.
>= 1.0.0, < 2.0.1
>= 3.0.0, < 3.0.1
Fixed in 2.0.1 or 3.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The typo3/phar-stream-wrapper package is a standalone package released under the MIT license. It provides a stream wrapper that intercepts direct invocations of Phar archives and allows or denies further processing based on individual rules. This package was originally part of the TYPO3 core and was extracted to be used in any PHP-driven project. The PharStreamWrapper overwrites the existing Phar handling of PHP, applies its own assertions, and then restores the native PHP Phar handling for corresponding commands. However, a vulnerability exists in the protection mechanism of the PharStreamWrapper interceptor.
Vulnerability Detail
The vulnerability, known as GHSA-4v5g-8pq2-32m2, is an insecure deserialization issue that occurs when untrusted data is used to abuse the logic of an application. In July 2018, the TYPO3 core addressed the insecure deserialization vulnerability when executing Phar archives. The PharStreamWrapper was introduced as a new interceptor to protect against possible vulnerabilities in 3rd party components. However, it was discovered that exception and error handlers in custom applications sometimes didn't return to the original operating sequence of the PharStreamWrapper, leaving the native PHP Phar handling vulnerable to insecure deserialization. This could potentially lead to remote code execution or other security breaches.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.0.0, < 2.0.12.0.1composer require typo3/phar-stream-wrapper:2.0.1 -
>= 3.0.0, < 3.0.13.0.1composer require typo3/phar-stream-wrapper:3.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The insecure deserialization vulnerability in typo3/phar-stream-wrapper can be fixed by updating the package to the recommended versions. It is important to ensure that custom exception and error handlers in your application properly return to the original operating sequence of the PharStreamWrapper. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/phar-stream-wrapper →
FAQ
Insecure deserialization is a vulnerability that occurs when untrusted data is used to abuse the logic of an application. It can lead to remote code execution or other security breaches.
The PharStreamWrapper is a stream wrapper that intercepts direct invocations of Phar archives and allows or denies further processing based on individual rules. It was introduced to protect against vulnerabilities in 3rd party components.
To fix the vulnerability in your TYPO3 extension, you should update the typo3/phar-stream-wrapper package to the recommended version. Additionally, ensure that your exception and error handlers properly return to the original operating sequence of the PharStreamWrapper.
There are no known exploits of this vulnerability at the moment. However, it is important to update the package to the fixed versions to prevent any potential security breaches.
You can find more information about this vulnerability in the TYPO3 advisory and the GitHub advisory database. Links to these sources are provided in the vulnerability details.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/phar-stream-wrapper.
