- Release Date: May 12, 2020
- Component Type: Third party extension. This extension is not a part of the TYPO3 default installation.
- Component: Direct Mail (ext:direct_mail)
- Vulnerability Type: Denial of Service, Broken Access Control, Open Redirect and Information Disclosure
- Affected Versions: 5.2.3 and below
- Severity: High
- Suggested CVSS v3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H/E:F/RL:O/RC:C
- References: CVE-2020-12697, CVE-2020-12698, CVE-2020-12699 and CVE-2020-12700
Problem Description
Denial of Service (CVE-2020-12697)
The extension provides a functionality to log clicks on links in sent newsletters. This functionality does not limit the amount of log entries generated per link, so it is possible to use a valid link to fill the log table with a huge amount of records.
Broken Access Control (CVE-2020-12698)
The extension fails to check if an authenticated backend user has access to newsletter subscriber tables (e.g. tt_address, fe_users) when using the CSV export function of the extension.
Open Redirect (CVE-2020-12699)
The extension does not properly implement “jumpUrl” handling, resulting in an Open Redirect for links sent in newsletters.
Information Disclosure (CVE-2020-12700)
The extension fails to check if an authenticated backend user has access to pages with newsletter subscriber data when using the "Special query" feature. Exploiting this issue leads to information disclosure, since it is possible to use the CSV export function of the extension to export subscriber data from pages the backend user does not have access to.
Solution
An updated version 5.2.4 is available from the TYPO3 extension manager and at
https://extensions.typo3.org/extension/download/direct_mail/5.2.4/zip/
Users of the extension are advised to update the extension as soon as possible.
Credits
Thanks to Gernot Leitgab for reporting the Information Disclosure Issue, Kurt Dirnbauer for reporting the Open Redirect Issue, TYPO3 security team member Torben Hansen for reporting the Denial of Service Issue and Ivan Kartolo for reporting the Broken Access Control issue and providing a fixed version of the extension.
General Advice
Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.