Professional Content Management

Free and open source, TYPO3 CMS is the most widely used enterprise-level CMS.

Test TYPO3 now:

TYPO3 live demo

Inspire people to share

Offer your skills and contribute to the project. The community is growing and does more than just coding. 

A Community Effort

TYPO3 CMS is an Open Source project managed by the TYPO3 Association.

The Project

Do you have a question?

Ask the community or a professional partner.

TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend Rendering

Categories: Development, TYPO3 CMS Created by Oliver Hader
It has been discovered that TYPO3 CMS is vulnerable to cross-site scripting.

Problem Description

TYPO3 core component GeneralUtility::getIndpEnv() uses the unfiltered server environment variable PATH_INFO, which allows attackers to inject malicious content.

In combination with the TypoScript setting config.absRefPrefix=auto, attackers can inject malicious HTML code into pages that have not yet been rendered and cached. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting).

Individual code which relies on the resolved value of GeneralUtility::getIndpEnv('SCRIPT_NAME') and corresponding usages (as shown below) are vulnerable as well.

  • GeneralUtility::getIndpEnv('PATH_INFO')
  • GeneralUtility::getIndpEnv('SCRIPT_NAME')
  • GeneralUtility::getIndpEnv('TYPO3_REQUEST_DIR')
  • GeneralUtility::getIndpEnv('TYPO3_REQUEST_SCRIPT')
  • GeneralUtility::getIndpEnv('TYPO3_SITE_PATH')
  • GeneralUtility::getIndpEnv('TYPO3_SITE_SCRIPT')
  • GeneralUtility::getIndpEnv('TYPO3_SITE_URL')

Installations of TYPO3 versions 8.7 and 9.x are probably only affected when server environment variable TYPO3_PATH_ROOT is defined - which is the case if they were installed via Composer.

Additional investigations confirmed that Apache and Microsoft IIS web servers using PHP-CGI (FPM, FCGI/FastCGI, or similar) are affected. There might be the risk that nginx is vulnerable as well. It was not possible to exploit Apache/mod_php scenarios.

Solution

The usage of server environment variable PATH_INFO has been removed from corresponding processings in GeneralUtility::getIndpEnv(). Besides that, the public property TypoScriptFrontendController::$absRefPrefix is encoded for both being used as a URI component and for being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability.

Update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.36 LTS, 11.5.23 LTS and 12.2.0 that fix the problem described above.

Strong security defaults - Manual actions required

Any web server using PHP-CGI (FPM, FCGI/FastCGI, or similar) needs to ensure that the PHP setting cgi.fix_pathinfo=1 is used, which is the default PHP setting. In case this setting is not enabled, an exception is thrown to avoid continuing with invalid path information.

For websites that cannot be patched timely the TypoScript setting config.absRefPrefix at least should be set to a static path value, instead of using auto - e.g. config.absRefPrefix=/ - this does not fix all aspects of the vulnerability, and is just considered to be an intermediate mitigation to the most prominent manifestation.

Credits

Thanks to Lars Michalowski, Kevin Andrews & Robin Martin who reported this issue, and to TYPO3 core team members Benjamin Franzke & Helmut Hummel who fixed the issue.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.

General Note

All security related code changes are tagged so that you can easily look them up in our review system.