#VU13828 Deserialization of untrusted data in TYPO3
Published: July 12, 2018
Vulnerability identifier: #VU13828
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber
CVE-ID: N/A
CWE-ID: CWE-502
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
TYPO3
TYPO3
Software vendor:
TYPO3
TYPO3
Description
The vulnerability allows a remote attacker to compromise vulnerable application.
The vulnerability exists due to Typo3 does not check content type of files and allows uploading of Phar files. A remote attacker with valid user account can upload a malicious phar file with a safe extension (e.g. jpg) and execute it on the system with privileges of the web server account.
Successful exploitation of the vulnerability allows remote PHP code execution but requires valid user credentials.
Remediation
Update to version 7.6.30, 8.7.17 or 9.3.1.