- Component Type: TYPO3 CMS
- Subcomponent: eID API (ext:frontend, ext:core)
- Release Date: July 28, 2020
- Vulnerability Type: Privilege Escalation, Remote Code Execution
- Affected Versions: 9.0.0-9.5.19, 10.0.0-10.4.5
- Severity: High
- Suggested CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
- References: CVE-2020-15099, CWE-20, CWE-200
Problem Description
In case an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php which again contains the encryptionKey as well as credentials of the database management system being used.
In case a database server is directly accessible either via internet or in a shared hosting network, this allows to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions.
Solution
Update to TYPO3 versions 9.5.20 or 10.4.6 that fix the problem described.
Credits
Thanks to TYPO3 security team member Oliver Hader who reported and fixed the issue.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.
General Note
All security related code changes are tagged so that you can easily look them up in our review system.