In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server. Scripts are then executed with the privileges of the victims' user session. In a worst-case scenario, new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it's actually a same-site request forgery. Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a third party extension, e.g. file upload in a contact form with knowing the target location. To be successful, the attacked victim requires an active and valid backend or install tool user session at the time of the attack. This has been fixed in 9.5.17 and 10.4.2. The deployment of additional mitigation techniques is suggested as described below. - Sudo Mode Extension This TYPO3 extension intercepts modifications to security relevant database tables, e.g. those storing user accounts or storages of the file abstraction layer. Modifications need to confirmed again by the acting user providing their password again. This technique is known as sudo mode. This way, unintended actions happening in the background can be mitigated. - https://github.com/FriendsOfTYPO3/sudo-mode - https://extensions.typo3.org/extension/sudo_mode - Content Security Policy Content Security Policies tell (modern) browsers how resources served a particular site are handled. It is also possible to disallow script executions for specific locations. In a TYPO3 context, it is suggested to disallow direct script execution at least for locations /fileadmin/ and /uploads/.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user
    interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked
    into interacting with a malicious resource an attacker previously managed to upload to the web server.
    Scripts are then executed with the privileges of the victims' user session. In a worst-case scenario, new
    admin users can be created which can directly be used by an attacker. The vulnerability is basically a
    cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on
    the same target host - thus, it's actually a same-site request forgery. Malicious payload such as HTML
    containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated
    user using a third party extension, e.g. file upload in a contact form with knowing the target location.
    To be successful, the attacked victim requires an active and valid backend or install tool user session at
    the time of the attack. This has been fixed in 9.5.17 and 10.4.2. The deployment of additional mitigation
    techniques is suggested as described below. - Sudo Mode Extension This TYPO3 extension intercepts
    modifications to security relevant database tables, e.g. those storing user accounts or storages of the
    file abstraction layer. Modifications need to confirmed again by the acting user providing their password
    again. This technique is known as sudo mode. This way, unintended actions happening in the background can
    be mitigated. - https://github.com/FriendsOfTYPO3/sudo-mode -
    https://extensions.typo3.org/extension/sudo_mode - Content Security Policy Content Security Policies tell
    (modern) browsers how resources served a particular site are handled. It is also possible to disallow
    script executions for specific locations. In a TYPO3 context, it is suggested to disallow direct script
    execution at least for locations /fileadmin/ and /uploads/. (CVE-2020-11069)

The version of TYPO3 installed on the remote host is 9.x prior to 9.5.17 or 10.x prior to 10.4.2. It is, therefore, affected by multiple vulnerabilities:
  - A cross-site scripting (XSS) vulnerability exists in Typo3's form engine component due to improper   validation of user-supplied input before returning it to users. An authenticated, remote attacker   can exploit this, by convincing a user to click a specially crafted URL, to execute arbitrary script   code in a user's browser session (CVE-2020-11064).

  - Multiple insecure deserialization vulnerabilities exist in Typo3. An authenticated, remote attacker   could exploit this, by crafting a specially crafted object, to execute arbitrary code   on an affected host (CVE-2020-11066 & CVE-2020-11067).

  - A server-side request forgery vulnerability exists in Typo3's backend user interface and install   tool components. An unauthenticated, remote attacker could exploit this, by uploading a specially   crafted file, to force the application to generate potentially malicious requests on their   behalf. (CVE-2020-11069).

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version

Typo3 News :

CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in Password Reset

It has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to verify whether a backend user account with a given email address exists or not.

CVE-2020-11064: TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form Engine

It has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting.
A valid backend user account is needed to exploit this vulnerability.

CVE-2020-11065: TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link Handling

It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.

CVE-2020-11066: TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

Calling unserialize() on malicious user-submitted content can result in the following scenarios :

- trigger deletion of arbitrary directory in file system (if writable for web server)

- trigger message submission via email using identity of website (mail relay)

Another insecure deserialization vulnerability is required to actually exploit mentioned aspects.

CVE-2020-11067: TYPO3-CORE-SA-2020-005: Insecure Deserialization in Backend User Settings

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

CVE-2020-11069: TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to Backend User Interface

It has been discovered that the backend user interface and install tool are vulnerable to same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.

In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it' actually a same-site request forgery (SSRF).

Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.

The attacked victim requires an active and valid backend or install tool user session at the time of the attack to be successful.

ID	Name	Product	Family	Severity
423525	SCA: security update for typo3/cms, typo3/cms-core (GHSA-pqg8-crx9-g8m4)	Tenable Cloud Security	SCA Checks	high
423525	SCA: security update for typo3/cms, typo3/cms-core (GHSA-pqg8-crx9-g8m4)	Tenable Self-Hosted Container Security	SCA Checks	high
138385	TYPO3 9.x < 9.5.17 / 10.x < 10.4.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical
136596	FreeBSD : typo3 -- multiple vulnerabilities (59fabdf2-9549-11ea-9448-08002728f74c)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2020-11069

high

Tenable Plugins

high

high

critical

critical