CVE-2023-24814: Persisted Cross-Site Scripting in Frontend Rendering in typo3
First published: Tue Feb 07 2023(Updated: )
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown below) are vulnerable as well. Additional investigations confirmed that at least Apache web server deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server environment variable `PATH_INFO` has been removed from corresponding processings in `GeneralUtility::getIndpEnv()`. Besides that, the public property `TypoScriptFrontendController::$absRefPrefix` is encoded for both being used as a URI component and for being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability. Users are advised to update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS and 12.2.0 which fix this problem. For users who are unable to patch in a timely manner the TypoScript setting `config.absRefPrefix` should at least be set to a static path value, instead of using auto - e.g. `config.absRefPrefix=/`. This workaround **does not fix all aspects of the vulnerability**, and is just considered to be an intermediate mitigation to the most prominent manifestation.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/typo3/cms | >=10.0.0<10.4.35>=11.0.0<11.5.23>=12.0.0<12.2.0 | |
| composer/typo3/cms-core | >=10.0.0<10.4.35>=11.0.0<11.5.23>=12.0.0<12.2.0 | |
| Typo3 Typo3 | >=8.7.0<9.7.51 | |
| Typo3 Typo3 | >=9.0.0<9.5.40 | |
| Typo3 Typo3 | >=10.0.0<10.4.36 | |
| Typo3 Typo3 | >=11.0.0<11.5.23 | |
| Typo3 Typo3 | >=12.0.0<12.2.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://typo3.org/security/advisory/typo3-core-sa-2023-001
- https://docs.typo3.org/m/typo3/reference-typoscript/main/en-us/Setup/Config/Index.html#absrefprefix
- https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/core/Classes/Utility/GeneralUtility.php#L2481-L2484
- https://github.com/TYPO3/typo3/blob/v11.5.22/typo3/sysext/frontend/Classes/Controller/TypoScriptFrontendController.php#L2547-L2549
- https://github.com/TYPO3/typo3/commit/0005a6fd86ab97eff8bf2e3a5828bf0e7cb6263a
- https://github.com/TYPO3/typo3/security/advisories/GHSA-r4f8-f93x-5qh3
- https://typo3.org/security/advisory/typo3-psa-2023-001
Frequently Asked Questions
What is TYPO3-CORE-SA-2023-001?
TYPO3-CORE-SA-2023-001 is a vulnerability in TYPO3 that allows attackers to inject malicious content through the unfiltered server environment variable PATH_INFO in the GeneralUtility::getIndpEnv() component.
How does the TYPO3-CORE-SA-2023-001 vulnerability affect software versions?
The TYPO3-CORE-SA-2023-001 vulnerability affects TYPO3 versions 8.7.0 to 9.7.51, 9.0.0 to 9.5.40, 10.0.0 to 10.4.35, 11.0.0 to 11.5.23, and 12.0.0 to 12.2.0.
What is the severity of the TYPO3-CORE-SA-2023-001 vulnerability?
The severity of the TYPO3-CORE-SA-2023-001 vulnerability is rated as high, with a severity value of 6.1.
How can I fix the TYPO3-CORE-SA-2023-001 vulnerability?
To fix the TYPO3-CORE-SA-2023-001 vulnerability, update TYPO3 CMS or TYPO3 CMS-Core to versions 10.4.36, 11.5.24, or 12.2.1, or apply the provided patches.
Where can I find more information about the TYPO3-CORE-SA-2023-001 vulnerability?
More information about the TYPO3-CORE-SA-2023-001 vulnerability can be found in the TYPO3 security advisory TYPO3-CORE-SA-2023-001, the TYPO3 documentation, and the TYPO3 GitHub repository.
- collector/friends-of-php
- collector/nvd-index
- agent/softwarecombine
- agent/first-publish-date
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/title
- agent/severity
- agent/author
- agent/weakness
- agent/tags
- agent/event
- agent/description
- package-manager/composer
- vendor/typo3
- canonical/typo3 typo3
- version/typo3 typo3/8.7.0
- version/typo3 typo3/9.0.0
- version/typo3 typo3/10.0.0
- version/typo3 typo3/11.0.0
- version/typo3 typo3/12.0.0