GHSA-f5rr-9r84-wwqf Typo3 Broken Access Control in Import Module
Regular backend users can bypass access controls in the Import module to upload files, potentially leading to privilege escalation and SQL injection.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-f5rr-9r84-wwqf?
GHSA-f5rr-9r84-wwqf is a missing authorization vulnerability in typo3/cms, published on 5 Jun 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
It has been discovered that the Import/Export module is susceptible to broken access control. Regular backend users have access to import functionality which usually only is available to admin users or users having User TSconfig setting options.impexp.enableImportForNonAdminUser explicitly enabled.
Database content to be imported however was correctly checked against users’ permissions and not affected. However it was possible to upload files by-passing restrictions of the file abstraction layer (FAL) - however this did not affect executable files which have been correctly secured by fileDenyPattern.
Currently the only known vulnerability is to directly inject *.form.yaml files which could be used to trigger the vulnerability of TYPO3-CORE-SA-2018-003 (privilege escalation & SQL injection) - which requires the Form Framework (ext:form) being available on an according website. CVSSv3 scoring is based on this scenario.
A valid backend user account is needed in order to exploit this vulnerability.
Which versions are affected by GHSA-f5rr-9r84-wwqf?
2 open source packages ship an affected version, including typo3/cms.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms Packagist | From 9.0.0 | 9.5.8 |
typo3/cms Packagist | From 9.0.0 | 9.5.8 |
How do I fix GHSA-f5rr-9r84-wwqf?
Upgrade typo3/cms to 9.5.8 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is GHSA-f5rr-9r84-wwqf being exploited?
There is no known exploitation of GHSA-f5rr-9r84-wwqf in the wild and no public exploit code.