CVE-2020-15086 Potential Remote Code Execution in TYPO3 with mediace extension
Attackers with access to an Extbase plugin can inject arbitrary data with valid checksums, leading to remote code execution in TYPO3 installations using the mediace extension.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-15086?
CVE-2020-15086 is a critical unsafe deserialization vulnerability in FriendsOfTYPO3 mediace, published on 29 Jul 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In TYPO3 installations with the "mediace" extension from version 7.6.2 and before version 7.6.5, it has been discovered that an internal verification mechanism can be used to generate arbitrary checksums. The allows to inject arbitrary data having a valid cryptographic message authentication code and can lead to remote code execution. To successfully exploit this vulnerability, an attacker must have access to at least one `Extbase` plugin or module action in a TYPO3 installation. This is fixed in version 7.6.5 of the "mediace" extension for TYPO3.
Which versions are affected by CVE-2020-15086?
2 open source packages ship an affected version, including friendsoftypo3/mediace. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
friendsoftypo3/mediace Packagist | From 7.6.2 | 7.6.5 |
friendsoftypo3/mediace Packagist | From 7.6.2 | 7.6.5 |
Products include Typo3 Mediace.
How do I fix CVE-2020-15086?
Upgrade friendsoftypo3/mediace to 7.6.5 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-15086 being exploited?
There is no known exploitation of CVE-2020-15086 in the wild and no public exploit code.
Sources
Also known as GHSA-4h44-w6fm-548g.