TYPO3-EXT-SA-2020-005: Multiple vulnerabilities in extension "Direct Mail" (direct_mail)

Categories: Development, Security Created by Torben Hansen
It has been discovered that the extension "Direct Mail" (direct_mail) is susceptible to Denial of Service, Broken Access Control, Open Redirect and Information Disclosure.

Problem Description

Denial of Service (CVE-2020-12697)
The extension provides a functionality to log clicks on links in sent newsletters. This functionality does not limit the amount of log entries generated per link, so it is possible to use a valid link to fill the log table with a huge amount of records.

Broken Access Control (CVE-2020-12698)
The extension fails to check if an authenticated backend user has access to newsletter subscriber tables (e.g. tt_address, fe_users) when using the CSV export function of the extension.

Open Redirect (CVE-2020-12699)
The extension does not properly implement “jumpUrl” handling, resulting in an Open Redirect for links sent in newsletters.

Information Disclosure (CVE-2020-12700)
The extension fails to check if an authenticated backend user has access to pages with newsletter subscriber data when using the "Special query" feature. Exploiting this issue leads to information disclosure, since it is possible to use the CSV export function of the extension to export subscriber data from pages the backend user does not have access to.

Solution

An updated version 5.2.4  is available from the TYPO3 extension manager and at
https://extensions.typo3.org/extension/download/direct_mail/5.2.4/zip/
Users of the extension are advised to update the extension as soon as possible.

Credits

Thanks to Gernot Leitgab for reporting the Information Disclosure Issue, Kurt Dirnbauer for reporting the Open Redirect Issue, TYPO3 security team member Torben Hansen for reporting the Denial of Service Issue and Ivan Kartolo for reporting the Broken Access Control issue and providing a fixed version of the extension.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.