CVE-2024-25121
published 2024-02-13CVE-2024-25121: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction…
PriorityP342high7.1CVSS 3.1
AVNACLPRLUINSUCHILAN
EPSS
0.50%
38.8th percentile
TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which fix the problem described. When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`.
Affected
18 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| typo3 | cms-core | >= 10.0.0 < 10.4.43 | 10.4.43 |
| typo3 | cms-core | >= 11.0.0 < 11.5.35 | 11.5.35 |
| typo3 | cms-core | >= 12.0.0 < 12.4.11 | 12.4.11 |
| typo3 | cms-core | >= 13.0.0 < 13.0.1 | 13.0.1 |
| typo3 | cms-core | >= 8.0.0 < 8.7.57 | 8.7.57 |
| typo3 | cms-core | >= 9.0.0 < 9.5.46 | 9.5.46 |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | — | — |
| typo3 | typo3 | >= 10.0.0 < 10.4.43 | 10.4.43 |
| typo3 | typo3 | >= 11.0.0 < 11.5.35 | 11.5.35 |
| typo3 | typo3 | >= 12.0.0 < 12.4.11 | 12.4.11 |
| typo3 | typo3 | >= 8.0.0 < 8.7.57 | 8.7.57 |
| typo3 | typo3 | >= 9.0.0 < 9.5.46 | 9.5.46 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
osv·2024-02-13
CVE-2024-25121 [HIGH] TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
### Problem
Entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account.
### Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
#### ℹ️ Strong security defaults - Manual actions required
When persisting
GHSA
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
ghsa·2024-02-13
CVE-2024-25121 [HIGH] CWE-200 TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler
### Problem
Entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account.
### Solution
Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described.
#### ℹ️ Strong security defaults - Manual actions required
When persisting
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-13
Published