=====================================================================

                              CERT-Renater

                   Note d'Information No. 2023/VULN058

_____________________________________________________________________

DATE                : 08/02/2023

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running TYPO3 versions prior to
                         8.7.51 ELTS, 9.5.40 ELTS, 10.4.36 LTS,
                                 11.5.23 LTS, 12.2.0.

=====================================================================
https://typo3.org/security/advisory/typo3-core-sa-2023-001
_____________________________________________________________________


  Tue. 7th February, 2023
TYPO3-CORE-SA-2023-001: Persisted Cross-Site Scripting in Frontend
Rendering

Categories: Development, TYPO3 CMS Created by Oliver Hader

It has been discovered that TYPO3 CMS is vulnerable to cross-site
scripting.

     Component Type: TYPO3 CMS
     Subcomponent: Frontend Rendering (ext:frontend, ext:core)
     Release Date: February 7, 2023
     Vulnerability Type: Cross-Site Scripting
     Affected Versions: 8.7.0-8.7.50, 9.0.0-9.5.39, 10.0.0-10.4.34,
                        11.0.0-11.5.22, 12.0.0-12.1.3
     Severity: High
     Suggested CVSS: 
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L/E:F/RL:O/RC:C
     References: CVE-2023-24814, CWE-79


Problem Description

TYPO3 core component GeneralUtility::getIndpEnv() uses the
  unfiltered server environment variable PATH_INFO, which allows
attackers to inject malicious content.

In combination with the TypoScript setting
config.absRefPrefix=auto, attackers can inject malicious HTML
code into pages that have not yet been rendered and cached. As
a result, injected values would be cached and delivered to other
website visitors (persisted cross-site scripting).

Individual code which relies on the resolved value of
GeneralUtility::getIndpEnv('SCRIPT_NAME') and corresponding usages
(as shown below) are vulnerable as well.

     GeneralUtility::getIndpEnv('PATH_INFO')
     GeneralUtility::getIndpEnv('SCRIPT_NAME')
     GeneralUtility::getIndpEnv('TYPO3_REQUEST_DIR')
     GeneralUtility::getIndpEnv('TYPO3_REQUEST_SCRIPT')
     GeneralUtility::getIndpEnv('TYPO3_SITE_PATH')
     GeneralUtility::getIndpEnv('TYPO3_SITE_SCRIPT')
     GeneralUtility::getIndpEnv('TYPO3_SITE_URL')

Installations of TYPO3 versions 8.7 and 9.x are probably only
affected when server environment variable TYPO3_PATH_ROOT is
defined - which is the case if they were installed via Composer.

Additional investigations confirmed that Apache and Microsoft IIS
web servers using PHP-CGI (FPM, FCGI/FastCGI, or similar) are
affected. There might be the risk that nginx is vulnerable as
well. It was not possible to exploit Apache/mod_php scenarios.


Solution

The usage of server environment variable PATH_INFO has been removed
from corresponding processings in GeneralUtility::getIndpEnv().
Besides that, the public property
TypoScriptFrontendController::$absRefPrefix is encoded for both
being used as a URI component and for being used as a prefix in an
HTML context. This mitigates the cross-site scripting vulnerability.

Update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.36 LTS,
11.5.23 LTS and 12.2.0 that fix the problem described above.


Strong security defaults - Manual actions required

Any web server using PHP-CGI (FPM, FCGI/FastCGI, or similar) needs
to ensure that the PHP setting cgi.fix_pathinfo=1 is used, which
is the default PHP setting. In case this setting is not enabled,
an exception is thrown to avoid continuing with invalid path
information.

For websites that cannot be patched timely the TypoScript setting
config.absRefPrefix at least should be set to a static path value,
instead of using auto - e.g. config.absRefPrefix=/ - this does not
fix all aspects of the vulnerability, and is just considered to be
an intermediate mitigation to the most prominent manifestation.


Credits

Thanks to Lars Michalowski, Kevin Andrews & Robin Martin who
reported this issue, and to TYPO3 core team members Benjamin Franzke
& Helmut Hummel who fixed the issue.


General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.
Please subscribe to the typo3-announce mailing list.


General Note

All security related code changes are tagged so that you can easily
look them up in our review system.



=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================