Oliver Hader

Several AJAX routes used for the backend localization wizard lack proper authorization checks. This allows authenticated users with low privileges to access information regarding records and content elements that are outside their permitted access range.

Users can upload files with arbitrary MIME types to forms utilizing FileUpload or ImageUpload elements that have `allowedMimeTypes` configured. This occurs because the `MimeTypeValidator` is registered during form building before concrete form definition properties are applied, which prevents the validator from being added to the processing pipeline and allows the server-side restriction to be bypassed.

A path allowance check in the `isAllowedAbsPath()` function of `GeneralUtility` uses a plain string prefix comparison that does not require a directory separator boundary. This allows paths that start with the same characters as the project root but are actually different directories (e.g., `/var/www/html-other/secret.yaml` when the root is `/var/www/html`) to be accepted as valid. Administrator users with access to the File Abstraction Layer can exploit this to create new file storage definitions pointing to directories outside the project root.

Editors with permissions to create or modify page content can include HTML markup in page titles. These titles are stored in the search index without sanitization and are subsequently rendered without proper output encoding when displayed in frontend search results via the Indexed Search plugin. This leads to Cross-Site Scripting, a condition where malicious scripts are injected into otherwise trusted websites.

Backend users with access to the Form Framework can utilize files that do not end with the `.form.yaml` extension as form definitions, as the system fails to deny incorrect file extensions. Maliciously crafted form definition files can be used to execute arbitrary SQL statements, enabling attackers to escalate privileges by creating administrative backend user accounts.

Authenticated backend users can retrieve file metadata through various Backend API routes due to insufficient permission checks. This allows users to access metadata for files located outside their authorized file mounts or storages.

Backend users with file write permissions can bypass upload restrictions in the Form Framework by using mixed-case extensions, such as `.FORM.YAML`. This allows the upload of maliciously crafted form definition files that can execute arbitrary SQL statements, enabling attackers to escalate privileges by creating administrative backend user accounts.

The cache frontend (VariableFrontend) and persistent key-value store (Registry) deserialize PHP payloads without integrity validation or class restrictions. An attacker with write access to the underlying storage backend, such as the file system or the `sys registry` database table, can inject a crafted serialized payload to trigger PHP Object Injection. This may allow the exploitation of a gadget chain to achieve Remote Code Execution.

Backend users with write access to the `form definition` database table can directly create, update, or delete form definition records using the DataHandler. This process bypasses the Form Framework's persistence validation and permission checks, enabling the injection of arbitrary form configurations. This can lead to SQL injection and privilege escalation.

When the `ALLOW INSECURE RAW TEXT` setting is enabled, the sanitizer fails to recognize closing tags containing whitespace variants, such as `</stylet>`. Because browsers interpret these as valid end tags, subsequent content can escape the sanitization process, enabling a bypass of the cross-site scripting prevention mechanism.

Changing backend users passwords through the user settings module causes the cleartext password to be stored in the `uc` and `user settings` fields of the `be users` database table.

A flaw exists in TYPO3 that allows local users with write access to the spool directory to execute arbitrary PHP code on the web server. This is possible by crafting a malicious file that is deserialized during the `mailer:spool:send` command.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: A deterministic three-character prefix in the Password Generation component reduces entropy, potentially enabling attackers to expedite brute-force attacks. Recommendations: Update TYPO3 CMS to a version later than 12.4.36. Update TYPO3 CMS to a version later than 13.4.17.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.54 TYPO3 CMS versions 10.0.0 through 10.4.53 TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: The Workspace Module in TYPO3 CMS is susceptible to missing authorization checks. This allows backend users to directly invoke the corresponding AJAX backend route, potentially disclosing sensitive information without proper access. Recommendations: TYPO3 CMS versions 9.0.0 through 9.5.54: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 10.0.0 through 10.4.53: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 11.0.0 through 11.5.47: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 12.0.0 through 12.4.36: Implement robust authorization checks for the Workspace Module's AJAX backend routes. TYPO3 CMS versions 13.0.0 through 13.4.17: Implement robust authorization checks for the Workspace Module's AJAX backend routes.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: An uncaught exception within the Bookmark Toolbar component allows administrator-level backend users to trigger a denial-of-service condition in the backend user interface. This occurs when saving manipulated data in the bookmark toolbar. Recommendations: Update TYPO3 CMS to a version later than 11.5.47. Update TYPO3 CMS to a version later than 12.4.36. Update TYPO3 CMS to a version later than 13.4.17.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: The CSV download feature lacks proper authorization checks. This allows backend users to disclose information from arbitrary database tables stored within their web mounts, even without having explicit access to those tables. Recommendations: Update TYPO3 CMS to a version beyond 11.5.47. Update TYPO3 CMS to a version beyond 12.4.36. Update TYPO3 CMS to a version beyond 13.4.17.

Name of the Vulnerable Software and Affected Versions: TYPO3 CMS versions 9.0.0 through 9.5.54 TYPO3 CMS versions 10.0.0 through 10.4.53 TYPO3 CMS versions 11.0.0 through 11.5.47 TYPO3 CMS versions 12.0.0 through 12.4.36 TYPO3 CMS versions 13.0.0 through 13.4.17 Description: An open-redirect vulnerability exists in the `GeneralUtility::sanitizeLocalUrl` function. This allows an attacker to redirect users to arbitrary external sites, potentially enabling phishing attacks through a manipulated, sanitized URL. Recommendations: TYPO3 CMS versions 9.0.0 through 9.5.54: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 10.0.0 through 10.4.53: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 11.0.0 through 11.5.47: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 12.0.0 through 12.4.36: At the moment, there is no information about a newer version that contains a fix for this vulnerability. TYPO3 CMS versions 13.0.0 through 13.4.17: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A problem has been discovered where the install tool password is logged as plaintext if the password hashing mechanism used for the password was incorrect. There are no known workarounds for this issue. Users are advised to update to a fixed version.

An issue was discovered in the powermail extension, resulting in Broken Access Control due to missing or insufficiently implemented access checks in several actions of the OutputController. This allows an unauthenticated attacker to edit, update, delete, or export data of persisted forms when the Powermail Frontend plugins are used.

In affected versions of TYPO3, entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this issue requires a valid backend user account.