Component Type: TYPO3 Core
Affected Versions: 4.3.11 and below, 4.4.8 and below, 4.5.3 and below
Vulnerability Types: Cross-Site Scripting (XSS), Information Disclosure, Authentication Delay Bypass, Unserialize() vulnerability, Missing Access Control
Overall Severity: High
Release Date: July 27, 2011
UPDATE: Please also read the buzz article concerning the changes made for these releases.
Vulnerable subcomponent #1: Frontend
Vulnerability Type: Cross-Site Scripting
Severity: High
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Failing to properly sanitize URL parameters the "JSwindow" property of the typolink function is susceptible to Cross-Site Scripting. The problem does not exist if the third party extension "realurl" is used and it's configuration parameter "doNotRawUrlEncodeParameterNames" is set to FALSE (default).
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to Marco Bresch who discovered and reported the issue.
Vulnerable subcomponent #2: Backend
Vulnerability Type: Information Disclosure
Severity: Low
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: For authentication attempts with wrong credentials, TYPO3 sends different HTTP-Headers depending if provided username or provided password is wrong.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to Sebastian Schinzel who discovered and reported the issue.
Vulnerability Type: Authentication Delay Bypass
Severity: Low
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: The TYPO3 Backend login has a delay for authentication attempts with wrong credentials. By using a crafted request, an attacker is able to bypass the madantory delay in such cases.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to Sebastian Schinzel who discovered and reported the issue.
Vulnerability Type: Cross-Site Scripting
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:N/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Failing to properly sanitize an username the admin panel is susceptible to Cross-Site Scripting.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to TYPO3 Security Team member Georg Ringer who discovered and reported the issue.
Vulnerability Type: Cross-Site Scripting
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Failing to properly sanitize a content element's link attribute the browse_links wizard is susceptible to Cross-Site Scripting. Exploiting requires an attacker to prepare a content element and trick its victim to open the browse_links wizard for this record.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to TYPO3 Security Team member Georg Ringer who discovered and reported the issue.
Vulnerability Type: Cross-Site Scripting
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Failing to properly sanitize a page title the system extension recycler is susceptible to Cross-Site Scripting. Exploiting requires an attacker to prepare a page and deleted page and trick its victim to visit the recycler.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to TYPO3 Core Team member Steffen Gebert who discovered and reported the issue.
Vulnerability Type: Cross-Site Scripting
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:H/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Failing to properly sanitize a page title the tcemain flash message is susceptible to Cross-Site Scripting. Exploiting requires an attacker to prepare a page and trick its victim to copy/move the prepared page.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to TYPO3 Security Team member Georg Ringer who discovered and reported the issue.
Vulnerability Type: Information Disclosure
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: A TYPO3 Backend user (editor) is able to see workspace changes of records in any languages - even for those he hasn't got granted access to.
Solution: Update to the TYPO3 versions 4.5.4 that fix the problem described.
Credits: Credits go to TYPO3 Workspaces Team member Michael Klapperer who discovered and reported the issue.
Vulnerability Type: Information Disclosure
Severity: High
Suggested CVSS v2.0: AV:N/AC:L/Au:S/C:C/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Using "getText" feature on headlines of content elements it is possible to retrieve arbitrary data from TYPO3 database. The vulnerability results from an insecure configuration in css_styled_content system extension.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Important Note: Having an adjusted fontTag property in the provided TypoScript (e.g. lib.stdheader.10.1.fontTag) or depending on headlines passed through fontTag might result in unexpected rendering results. Headline rendering is now handled through dataWrap (e.g. lib.stdheader.10.1.dataWrap). Make sure to check your TypoScript before the update and check the wesite rendering after it!
Credits: Credits go to Mads Chr. Olesen who discovered and reported the issue.
Vulnerability Type: Unserialize() vulnerability
Severity: High
Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:P/I:C/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: Special user input of BE editors is treated as serialized data and is deserialized by TYPO3. This allows BE editors to delete any arbitrary file the webserver has access to.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to TYPO3 Security Team member Marcus Krause who discovered and reported the issue.
Vulnerable subcomponent #3: Exposed API
Vulnerability Type: Cross-Site Scripting
Severity: Medium
Suggested CVSS v2.0: AV:N/AC:M/Au:N/C:P/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: The RemoveXSS function fails to sanitize an attack vector that works in Internet Explorer version 6.
Solution: Update to the TYPO3 versions 4.3.12, 4.4.9 or 4.5.4 that fix the problem described.
Credits: Credits go to Vladimir Podkovanov who discovered and reported the issue.
Vulnerability Type: Missing Access Control
Severity: High
Suggested CVSS v2.0: AV:N/AC:M/Au:S/C:P/I:P/A:N/E:U/RL:OF/RC:C (What's that?)
Problem Description: ExtDirect endpoints are not associated with TYPO3 backend modules and such TYPO3 access control is not applied on ExtDirect calls. This allows arbitrary BE users to consume any available ExtDirect endpoint service.
Solution: Update to the TYPO3 versions 4.4.9 or 4.5.4 that fix the problem described.
Note: From now on ExtDirect components need to be registered through t3lib_extMgm::registerExtDirectComponent() function call.
Credits: Credits go to TYPO3 Security Team member Helmut Hummel who discovered and reported the issue.
General advice: Follow the recommendations that are given in the TYPO3 Security Cookbook. Please subscribe to thetypo3-announce mailing list to receive future Security Bulletins via E-mail.