CVE-2024-25121: Improper Access Control Persisting File Abstraction Layer Entities via Data Handler in TYPO3
Problem Entities of the File Abstraction Layer (FAL) could be persisted directly via DataHandler. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account.
Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
ℹ️ Strong security defaults - Manual actions required
When persisting entities of the File Abstraction Layer directly via DataHandler, sysfile entities are now denied by default, and sysfilereference & sysfilemetadata entities are not permitted to reference files in the fallback storage anymore.
When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using $dataHandler->isImporting = true;.
Credits Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.
References TYPO3-CORE-SA-2024-006
Other sources
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via DataHandler. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, sysfile entities are now denied by default, and sysfilereference & sysfilemetadata entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using $dataHandler->isImporting = true;.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 13.0.1 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 12.4.11 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 11.5.35 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 10.4.43 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 9.5.46 - Upgrade
Upgrade
composer/typo3/cms-coreto a version that resolves this vulnerability.Fixed in 8.7.57 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 8.7.57 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 9.5.46 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 10.4.43 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 11.5.35 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 12.4.11 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 13.0.1 - Configuration
When importing data from secure origins, explicitly enable importing in the corresponding DataHandler instance by setting `$dataHandler->isImporting = true;`.
TYPO3 DataHandler isImporting = true - Configuration
After upgrading, ensure the default FAL access controls are enforced: `sys_file` entities are denied by default, and `sys_file_reference` & `sys_file_metadata` entities must not reference files in the fallback storage ("zero-storage").
TYPO3 File Abstraction Layer (FAL) via DataHandler FAL entity persistence rules for DataHandler = deny sys_file; restrict sys_file_reference & sys_file_metadata fallback storage
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25121?
CVE-2024-25121 has been classified with a significant severity as it can lead to unauthorized access to sensitive file data.
How do I fix CVE-2024-25121?
To mitigate CVE-2024-25121, update TYPO3 to versions 13.0.1, 12.4.11, 11.5.35, 10.4.43, 9.5.46, or 8.7.57.
What types of software are affected by CVE-2024-25121?
CVE-2024-25121 affects multiple TYPO3 CMS versions, specifically those from 8.0.0 to 13.0.0.
What vulnerability mechanism is involved in CVE-2024-25121?
CVE-2024-25121 exploits a flaw in the File Abstraction Layer, allowing attackers to reference and access fallback storage files.
Can I track updates or references for CVE-2024-25121?
Yes, updates and references for CVE-2024-25121 can be found in TYPO3 security advisories and GitHub repositories.