Deserialization of untrusted data in TYPO3 - #VU13828
Published: July 12, 2018
Vulnerability identifier: #VU13828
CSH Severity: High
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to compromise vulnerable application.
The vulnerability exists due to Typo3 does not check content type of files and allows uploading of Phar files. A remote attacker with valid user account can upload a malicious phar file with a safe extension (e.g. jpg) and execute it on the system with privileges of the web server account.
Successful exploitation of the vulnerability allows remote PHP code execution but requires valid user credentials.
Affected software
TYPO3
phar-stream-wrapper
phar-stream-wrapper
Remediation
Update to version 7.6.30, 8.7.17 or 9.3.1.
TYPO3 - addressed in versions 7.6.30, 8.7.17, 9.3.1
phar-stream-wrapper - addressed in versions 2.0.1, 3.0.1
phar-stream-wrapper - addressed in versions 2.0.1, 3.0.1