Vulnerability identifier: #VU13828

Vulnerability risk: High

CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: N/A

CWE-ID: CWE-502

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
TYPO3
Web applications / CMS

Vendor: TYPO3

Description

The vulnerability allows a remote attacker to compromise vulnerable application.

The vulnerability exists due to Typo3 does not check content type of files and allows uploading of Phar files. A remote attacker with valid user account can upload a malicious phar file with a safe extension (e.g. jpg) and execute it on the system with privileges of the web server account.

Successful exploitation of the vulnerability allows remote PHP code execution but requires valid user credentials.

Mitigation
Update to version 7.6.30, 8.7.17 or 9.3.1.

Vulnerable software versions

TYPO3: 7.6.0 - 7.6.29, 8.0.0 - 8.7.16, 9.0.0 - 9.3.0

---

External links
http://typo3.org/security/advisory/typo3-core-sa-2018-002/

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.