FreeBSD : typo3 -- multiple vulnerabilities (59fabdf2-9549-11ea-9448-08002728f74c)

critical Nessus Plugin ID 136596

Language:

Synopsis

The remote FreeBSD host is missing one or more security-related updates.

Description

Typo3 News :

CVE-2020-11063: TYPO3-CORE-SA-2020-001: Information Disclosure in Password Reset

It has been discovered that time-based attacks can be used with the password reset functionality for backend users. This allows an attacker to verify whether a backend user account with a given email address exists or not.

CVE-2020-11064: TYPO3-CORE-SA-2020-002: Cross-Site Scripting in Form Engine

It has been discovered that HTML placeholder attributes containing data of other database records are vulnerable to cross-site scripting.
A valid backend user account is needed to exploit this vulnerability.

CVE-2020-11065: TYPO3-CORE-SA-2020-003: Cross-Site Scripting in Link Handling

It has been discovered that link tags generated by typolink functionality are vulnerable to cross-site scripting - properties being assigned as HTML attributes have not been parsed correctly.

CVE-2020-11066: TYPO3-CORE-SA-2020-004: Class destructors causing side-effects when being unserialized

Calling unserialize() on malicious user-submitted content can result in the following scenarios :

- trigger deletion of arbitrary directory in file system (if writable for web server)

- trigger message submission via email using identity of website (mail relay)

Another insecure deserialization vulnerability is required to actually exploit mentioned aspects.

CVE-2020-11067: TYPO3-CORE-SA-2020-005: Insecure Deserialization in Backend User Settings

It has been discovered that backend user settings (in $BE_USER->uc) are vulnerable to insecure deserialization. In combination with vulnerabilities of 3rd party components this can lead to remote code execution. A valid backend user account is needed to exploit this vulnerability.

CVE-2020-11069: TYPO3-CORE-SA-2020-006: Same-Site Request Forgery to Backend User Interface

It has been discovered that the backend user interface and install tool are vulnerable to same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to the web server - scripts are then executed with the privileges of the victims' user session.

In a worst case scenario new admin users can be created which can directly be used by an attacker. The vulnerability is basically a cross-site request forgery (CSRF) triggered by a cross-site scripting vulnerability (XSS) - but happens on the same target host - thus, it' actually a same-site request forgery (SSRF).

Malicious payload such as HTML containing JavaScript might be provided by either an authenticated backend user or by a non-authenticated user using a 3rd party extension - e.g. file upload in a contact form with knowing the target location.

The attacked victim requires an active and valid backend or install tool user session at the time of the attack to be successful.

Solution

Update the affected packages.

Plugin Details

Severity: Critical

ID: 136596

File Name: freebsd_pkg_59fabdf2954911ea944808002728f74c.nasl

Version: 1.4

Type: local

Family: FreeBSD Local Security Checks

Published: 5/14/2020

Updated: 5/13/2022

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: High

Score: 7.1

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2020-11069

CVSS v3

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS Score Source: CVE-2020-11066

Vulnerability Information

CPE: p-cpe:/a:freebsd:freebsd:typo3-10-php72, p-cpe:/a:freebsd:freebsd:typo3-10-php73, p-cpe:/a:freebsd:freebsd:typo3-10-php74, p-cpe:/a:freebsd:freebsd:typo3-9-php72, p-cpe:/a:freebsd:freebsd:typo3-9-php73, p-cpe:/a:freebsd:freebsd:typo3-9-php74, cpe:/o:freebsd:freebsd

Required KB Items: Host/local_checks_enabled, Host/FreeBSD/release, Host/FreeBSD/pkg_info

Exploit Ease: No known exploits are available

Patch Publication Date: 5/13/2020

Vulnerability Publication Date: 5/12/2020

Reference Information

CVE: CVE-2020-11063, CVE-2020-11064, CVE-2020-11065, CVE-2020-11066, CVE-2020-11067, CVE-2020-11069

Detections

Analytics