TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, and 13.0.1.

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 1ad3d264-e36b-11ee-9c27-40b034429ecf advisory.

  - In TYPO3 11.5.24, the filelist component allows attackers (who have access to the administrator panel) to     read arbitrary files via directory traversal in the baseuri field, as demonstrated by POST     /typo3/record/edit with ../../../ in data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
    (CVE-2023-30451)

  - TYPO3 before 13.0.1 allows an authenticated admin user (with system maintainer privileges) to execute     arbitrary shell commands (with the privileges of the web server) via a command injection vulnerability in     form fields of the Install Tool. The fixed versions are 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35     LTS, 12.4.11 LTS, and 13.0.1. (CVE-2024-22188)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. Password     hashes were being reflected in the editing forms of the TYPO3 backend user interface. This allowed     attackers to crack the plaintext password using brute force techniques. Exploiting this vulnerability     requires a valid backend user account. Users are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46     ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. There are no known     workarounds for this issue. (CVE-2024-25118)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. The plaintext     value of `$GLOBALS['SYS']['encryptionKey']` was displayed in the editing forms of the TYPO3 Install Tool     user interface. This allowed attackers to utilize the value to generate cryptographic hashes used for     verifying the authenticity of HTTP request parameters. Exploiting this vulnerability requires an     administrator-level backend user account with system maintainer permissions. Users are advised to update     to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the     problem described. There are no known workarounds for this vulnerability. (CVE-2024-25119)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. The     TYPO3-specific `t3://` URI scheme could be used to access resources outside of the users' permission     scope. This encompassed files, folders, pages, and records (although only if a valid link-handling     configuration was provided). Exploiting this vulnerability requires a valid backend user account. Users     are advised to update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS,     13.0.1 that fix the problem described. There are no known workarounds for this issue. (CVE-2024-25120)

  - TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected     versions of TYPO3 entities of the File Abstraction Layer (FAL) could be persisted directly via     `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve     their file names and contents. The fallback storage (zero-storage) is used as a backward compatibility     layer for files located outside properly configured file storages and within the public web root     directory. Exploiting this vulnerability requires a valid backend user account. Users are advised to     update to TYPO3 version 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1 which     fix the problem described. When persisting entities of the File Abstraction Layer directly via     DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata`     entities are not permitted to reference files in the fallback storage anymore. When importing data from     secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using     `$dataHandler->isImporting = true;`. (CVE-2024-25121)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of TYPO3 installed on the remote host is prior to 8.0.0 < 8.7.57 ELTS / 9.0.0 < 9.5.46 ELTS / 10.0.0 < 10.4.43 ELTS / 11.0.0 < 11.5.35 / 12.0.0 < 12.4.11 / 13.0.1. It is, therefore, affected by a vulnerability as referenced in the TYPO3-CORE-SA-2024-002 advisory.

  - Several settings in the Install Tool for configuring the path to system binaries were vulnerable to code     execution. Exploiting this vulnerability requires an administrator-level backend user account with system     maintainer permissions. The corresponding change for this advisory involves enforcing the known     disadvantages described in TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode. (CVE-2024-22188)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
192184	FreeBSD : typo3-{11,12} -- multiple vulnerabilities (1ad3d264-e36b-11ee-9c27-40b034429ecf)	Nessus	FreeBSD Local Security Checks	high
190467	TYPO3 8.0.0 < 8.7.57 ELTS / 9.0.0 < 9.5.46 ELTS / 10.0.0 < 10.4.43 ELTS / 11.0.0 < 11.5.35 / 12.0.0 < 12.4.11 / 13.0.1 (TYPO3-CORE-SA-2024-002)	Nessus	CGI abuses	high

Detections

Analytics

CVE-2024-22188

high

Tenable Plugins

high

high