CVE-2023-24814 in TYPO3
Summary
by MITRE • 02/07/2023
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows attackers to inject malicious content. In combination with the TypoScript setting `config.absRefPrefix=auto`, attackers can inject malicious HTML code to pages that have not been rendered and cached, yet. As a result, injected values would be cached and delivered to other website visitors (persisted cross-site scripting). Individual code which relies on the resolved value of `GeneralUtility::getIndpEnv('SCRIPT_NAME')` and corresponding usages (as shown below) are vulnerable as well. Additional investigations confirmed that at least Apache web server deployments using CGI (FPM, FCGI/FastCGI, and similar) are affected. However, there still might be the risk that other scenarios like nginx, IIS, or Apache/mod_php are vulnerable. The usage of server environment variable `PATH_INFO` has been removed from corresponding processings in `GeneralUtility::getIndpEnv()`. Besides that, the public property `TypoScriptFrontendController::$absRefPrefix` is encoded for both being used as a URI component and for being used as a prefix in an HTML context. This mitigates the cross-site scripting vulnerability. Users are advised to update to TYPO3 versions 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS and 12.2.0 which fix this problem. For users who are unable to patch in a timely manner the TypoScript setting `config.absRefPrefix` should at least be set to a static path value, instead of using auto - e.g. `config.absRefPrefix=/`. This workaround **does not fix all aspects of the vulnerability**, and is just considered to be an intermediate mitigation to the most prominent manifestation.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 02/07/2023
The vulnerability identified as CVE-2023-24814 affects TYPO3 content management framework versions that utilize the GeneralUtility::getIndpEnv() function to process server environment variables. This flaw specifically exploits the unfiltered PATH_INFO variable, creating a persistent cross-site scripting vulnerability when combined with the TypoScript setting config.absRefPrefix=auto. The vulnerability stems from improper input validation and sanitization of server environment variables, allowing attackers to inject malicious HTML content that gets cached and subsequently delivered to unsuspecting users. This represents a classic persistent XSS vulnerability where malicious payloads are stored server-side and executed in the context of other users' browsers.
The technical implementation of this vulnerability occurs through the manipulation of server environment variables within the TYPO3 core component. When the GeneralUtility::getIndpEnv() function processes the PATH_INFO variable without proper sanitization, it allows attackers to inject content that gets stored in the application's cache system. The vulnerability is particularly dangerous because it affects pages that have not yet been rendered and cached, meaning that even future visitors to those pages could be impacted. The attack vector becomes more severe when combined with the config.absRefPrefix=auto setting, which automatically determines reference prefixes, creating an environment where malicious input can be seamlessly integrated into the application's output. This issue has been classified under CWE-79 as a Cross-Site Scripting vulnerability, specifically targeting persistent XSS scenarios where user-controllable data is stored and later executed.
The operational impact of this vulnerability extends across multiple deployment scenarios including Apache web servers using CGI, FPM, and FastCGI configurations. While the primary affected environments are Apache deployments with CGI modules, there remains potential risk for other server configurations such as nginx, IIS, and Apache/mod_php installations. The vulnerability affects the TypoScriptFrontendController::$absRefPrefix property, which is used for generating absolute reference prefixes in web applications. This creates a significant security risk for organizations relying on TYPO3 for content management, as malicious actors could potentially inject scripts that execute in the browsers of other users, leading to session hijacking, data theft, or further exploitation of the web application. The caching mechanism exacerbates the impact since the injected content becomes persistent and affects multiple users over time.
Security mitigations for CVE-2023-24814 include updating to patched TYPO3 versions including 8.7.51 ELTS, 9.5.40 ELTS, 10.4.35 LTS, 11.5.23 LTS, and 12.2.0. The core fix involves removing the usage of PATH_INFO from the GeneralUtility::getIndpEnv() processing and implementing proper encoding for the public property TypoScriptFrontendController::$absRefPrefix. This encoding ensures that values are safe for both URI component usage and HTML context rendering, preventing malicious content from being executed. Organizations unable to patch immediately should implement the workaround of setting config.absRefPrefix to a static path value like config.absRefPrefix=/ instead of using the auto setting. This mitigation, while not comprehensive, helps reduce the most prominent manifestation of the vulnerability by eliminating the automatic prefix determination that enables the attack. The vulnerability's classification under ATT&CK technique T1566.001 (Phishing with Malicious Link) and T1584.002 (Compromise Infrastructure) highlights its potential for broader exploitation within the threat landscape, particularly in scenarios where attackers seek to establish persistent access through web application vulnerabilities.