Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1yajN4LXd2YzYtNWo2Ns4AA5P4

TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler

Problem

Entities of the File Abstraction Layer (FAL) could be persisted directly via DataHandler. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account.

Solution

Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.

ℹ️ Strong security defaults - Manual actions required

When persisting entities of the File Abstraction Layer directly via DataHandler, sys_file entities are now denied by default, and sys_file_reference & sys_file_metadata entities are not permitted to reference files in the fallback storage anymore.

When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using $dataHandler->isImporting = true;.

Credits

Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue.

References

• TYPO3-CORE-SA-2024-006

Permalink: https://github.com/advisories/GHSA-rj3x-wvc6-5j66
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1yajN4LXd2YzYtNWo2Ns4AA5P4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: 3 months ago
Updated: 2 months ago

CVSS Score: 7.1
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N

Identifiers: GHSA-rj3x-wvc6-5j66, CVE-2024-25121
References:

• https://github.com/TYPO3/typo3/security/advisories/GHSA-rj3x-wvc6-5j66
• https://github.com/TYPO3/typo3/commit/38f0bf9a61e10365be26eb75bc23a81184dbed07
• https://github.com/TYPO3/typo3/commit/71e652bf84b16fd3592205f61f36750ab03db74c
• https://github.com/TYPO3/typo3/commit/b47b6ddf5a5f3f852c6e43f837360780c12e3c47
• https://typo3.org/security/advisory/typo3-core-sa-2024-006
• https://nvd.nist.gov/vuln/detail/CVE-2024-25121
• https://github.com/advisories/GHSA-rj3x-wvc6-5j66

Repository: https://github.com/TYPO3/typo3
Blast Radius: 25.5

Affected Packages