Benjamin Franzke

Referrer enforcement became ineffective because the backend and Install Tool applications are served from the site's main entry script rather than a dedicated directory. The system determines if a request originated from the backend or Install Tool by comparing the referrer against the entry script directory, which is now the site root. Consequently, requests from any script on the instance's own domains, such as frontend pages, are accepted by backend routes and Install Tool endpoints. An attacker capable of executing JavaScript on these domains could use Fetch or XHR to invoke these endpoints using the privileges of an authenticated user's session.

Applications utilizing the `sanitizeLocalUrl()` function within the `GeneralUtility` class to restrict URLs to local addresses are susceptible to open redirect attacks. This occurs when a URL is used after passing the sanitization checks, allowing attackers to redirect users to external malicious content, which can be leveraged for phishing attacks.

Backend users with file write permissions can bypass upload restrictions in the Form Framework by using mixed-case extensions, such as `.FORM.YAML`. This allows the upload of maliciously crafted form definition files that can execute arbitrary SQL statements, enabling attackers to escalate privileges by creating administrative backend user accounts.

Namespace attributes are not encoded correctly during HTML serialization. This flaw allows the cross-site scripting prevention mechanism to be bypassed. Cross-site scripting is a technique where malicious scripts are injected into otherwise benign and trusted websites.

An issue exists where manipulation of the `defVals` parameter can bypass field-level access checks during record creation within the TYPO3 backend. Successful exploitation allows attackers to insert arbitrary data into restricted fields of a database table, provided the user already possesses write permissions for a limited set of fields.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: The CSV download feature lacks proper authorization checks. This allows backend users to disclose information from arbitrary database tables stored within their web mounts, even without having explicit access to those tables. Recommendations: Update TYPO3 CMS to a version beyond 11.5.47. Update TYPO3 CMS to a version beyond 12.4.36. Update TYPO3 CMS to a version beyond 13.4.17.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.54 TYPO3 CMS versions 10.0.0 through 10.4.53 TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: An open-redirect vulnerability exists in the `GeneralUtility::sanitizeLocalUrl` function. This allows an attacker to redirect users to arbitrary external sites, potentially enabling phishing attacks through a manipulated, sanitized URL. Recommendations: TYPO3 CMS versions 9.0.0 through 9.5.54: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 10.0.0 through 10.4.53: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 11.0.0 through 11.5.47: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 12.0.0 through 12.4.36: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 13.0.0 through 13.4.17: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The form manager backend module is vulnerable to cross-site scripting. Exploiting this issue requires a valid backend user account with access to the form module.

The plaintext value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for verifying the authenticity of HTTP request parameters. Exploiting this issue requires an administrator-level backend user account with system maintainer permissions.

The issue is related to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses this header to generate absolute URLs, but since it is provided by the client, it can be forged. A regression during TYPO3 v11 development led to this vulnerability, as the existing setting `$GLOBALS['TYPO3 CONF VARS']['SYS']['trustedHostsPattern']` was not evaluated anymore.