Professional Content Management

Free and open source, TYPO3 CMS is the most widely used enterprise-level CMS.

Test TYPO3 now:

TYPO3 live demo

Inspire people to share

Offer your skills and contribute to the project. The community is growing and does more than just coding. 

A Community Effort

TYPO3 CMS is an Open Source project managed by the TYPO3 Association.

The Project

Do you have a question?

Ask the community or a professional partner.

TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode

Categories: Development, TYPO3 CMS Created by Oliver Hader
Accessing Install Tool via TYPO3 Backend requires password verification - known as Sudo Mode.
  • Component Type: TYPO3 CMS
  • Subcomponent: Install Tool (ext:install)
  • Release Date: November 17, 2020
  • Affected Versions: 9.0.0-9.5.22, 10.0.0-10.4.9

Problem Description

When the system maintainer concept was introduced with TYPO3 v9.0.0 the necessity of having to enter a password when accessing the Install Tool via backend user interface was removed.

However, the Install Tool allows one to define various configurations as well as arguments and paths for low-level binary applications to take care of further processing.

Per definition, all of these actions and features qualify as “remote code execution”. There is no problem when those are used by valid system maintainers - however, it also could be used as a valid attack vector in case user sessions have been hijacked by other vulnerabilities in any software component on the same server - such as cross-site scripting or SQL injection.

Solution

The ideal solution would be to omit the presence of the Install Tool component on a website in production - which is however not feasible for all environments. Thus, protecting the entry point is currently the best way to mitigate unintentional access to the Install Tool via the backend user interface.

Users now have to enter either their user password or the “Install Tool password” to get corresponding access. This mechanism is known as Sudo Mode.

It is suggested to update to TYPO3 versions 9.5.23 or 10.4.10 that mitigate the problem described by introducing Sudo Mode for accessing the Install Tool via the backend user interface.

Maintainers of extensions that provide remote, single sign-on, or multi-factor authentication are advised to check technical details and potential implications for their extensions.

This change is enforcing the suggestions of TYPO3-CORE-SA-2020-006.

Credits

Thanks to Sinan Sekerci (Dreamlab Technologies) who brought this topic again to our attention and to TYPO3 security team member Oliver Hader who introduced Sudo Mode to mitigate the issue.

General Advice

Follow the recommendations that are given in the TYPO3 Security Guide. Please subscribe to the typo3-announce mailing list.