TYPO3 CMS up to 9.5.19/10.4.5 LocalConfiguration.php information disclosure

Summaryinfo

A vulnerability categorized as critical has been discovered in TYPO3 CMS up to 9.5.19/10.4.5. Affected by this issue is some unknown functionality of the file typo3conf/LocalConfiguration.php. Executing a manipulation can lead to information disclosure. This vulnerability is registered as CVE-2020-15099. It is possible to launch the attack remotely. No exploit is available. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability has been found in TYPO3 CMS up to 9.5.19/10.4.5 (Content Management System) and classified as critical. This vulnerability affects an unknown functionality of the file typo3conf/LocalConfiguration.php. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

In TYPO3 CMS greater than or equal to 9.0.0 and less than 9.5.20, and greater than or equal to 10.0.0 and less than 10.4.6, in a case where an attacker manages to generate a valid cryptographic message authentication code (HMAC-SHA1) - either by using a different existing vulnerability or in case the internal encryptionKey was exposed - it is possible to retrieve arbitrary files of a TYPO3 installation. This includes the possibility to fetch typo3conf/LocalConfiguration.php, which again contains the encryptionKey as well as credentials of the database management system being used. In case a database server is directly accessible either via internet or in a shared hosting network, this allows the ability to completely retrieve, manipulate or delete database contents. This includes creating an administration user account - which can be used to trigger remote code execution by injecting custom extensions. This has been patched in versions 9.5.20 and 10.4.6.

The weakness was published 07/29/2020 (GitHub Repository). The advisory is shared for download at github.com. This vulnerability was named CVE-2020-15099 since 06/25/2020. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1592.

By approaching the search of inurl:typo3conf/LocalConfiguration.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 9.5.20 or 10.4.6 eliminates this vulnerability.

Similar entry is available at VDB-159159. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Content Management System

Vendor

• TYPO3

Name

• CMS

Version

• 9.5.0
• 9.5.1
• 9.5.2
• 9.5.3
• 9.5.4
• 9.5.5
• 9.5.6
• 9.5.7
• 9.5.8
• 9.5.9
• 9.5.10
• 9.5.11
• 9.5.12
• 9.5.13
• 9.5.14
• 9.5.15
• 9.5.16
• 9.5.17
• 9.5.18
• 9.5.19
• 10.4.0
• 10.4.1
• 10.4.2
• 10.4.3
• 10.4.4
• 10.4.5

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion