Deserialization of untrusted data in PharStreamWrapper Interceptor for TYPO3 CMS

1) Deserialization of untrusted data

EUVDB-ID: #VU13828

Risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-502 - Deserialization of Untrusted Data

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise vulnerable application.

The vulnerability exists due to Typo3 does not check content type of files and allows uploading of Phar files. A remote attacker with valid user account can upload a malicious phar file with a safe extension (e.g. jpg) and execute it on the system with privileges of the web server account.

Successful exploitation of the vulnerability allows remote PHP code execution but requires valid user credentials.

Mitigation

Update to version 2.0.1 or 3.0.1.

Vulnerable software versions

phar-stream-wrapper: 1.0.0 - 3.0.0

External links

http://typo3.org/security/advisory/typo3-psa-2018-001/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.