GHSA-gqqf-g5r7-84vf TYPO3 HTML Sanitizer Bypasses Cross-Site Scripting Protection
Attackers can bypass XSS protection in TYPO3 via malicious HTML comments, potentially executing scripts in victim browsers.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-gqqf-g5r7-84vf?
GHSA-gqqf-g5r7-84vf is a cross-site scripting vulnerability in typo3/cms-core, published on 15 Sep 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
> ### Meta
> * CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:F/RL:O/RC:C (5.7)
Problem
Due to a parsing issue in upstream package masterminds/html5, malicious markup used in a sequence with special HTML comments cannot be filtered and sanitized. This allows to by-pass the cross-site scripting mechanism of typo3/html-sanitizer.
Solution
Update to TYPO3 version 7.6.58 ELTS, 8.7.48 ELTS, 9.5.37 ELTS, 10.4.32 or 11.5.16 that fix the problem described above.
Credits
Thanks to David Klein who reported this issue, and to TYPO3 security team member Oliver Hader who fixed the issue.
References
Which versions are affected by GHSA-gqqf-g5r7-84vf?
10 open source packages ship an affected version, including typo3/cms-core.
| Package | Affected | Fixed in |
|---|---|---|
typo3/cms-core Packagist | From 10.0.0 | 10.4.32 |
typo3/cms-core Packagist | From 10.0.0 | 10.4.32 |
typo3/cms-core Packagist | From 11.0.0 | 11.5.16 |
typo3/cms-core Packagist | From 11.0.0 | 11.5.16 |
typo3/cms-core Packagist | From 7.0.0 | 7.6.58 |
typo3/cms-core Packagist | From 7.0.0 | 7.6.58 |
4 more packages
typo3/cms-core Packagist | From 8.0.0 | 8.7.48 |
typo3/cms-core Packagist | From 8.0.0 | 8.7.48 |
typo3/cms-core Packagist | From 9.0.0 | 9.5.37 |
typo3/cms-core Packagist | From 9.0.0 | 9.5.37 |
How do I fix GHSA-gqqf-g5r7-84vf?
Upgrade typo3/cms-core to a fixed version for your release line: 10.4.32, 11.5.16, 7.6.58 or 8.7.48.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is GHSA-gqqf-g5r7-84vf being exploited?
There is no known exploitation of GHSA-gqqf-g5r7-84vf in the wild and no public exploit code.