CVE-2023-47126: Insufficient Information (NVD-CWE-noinfo)
value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.

CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
CVSS v3 base score: 5.3
Published: 2023-11-14T20:15Z
Repository: https://github.com/TYPO3/typo3
Language: PHP
Files changed: typo3/sysext/install/Classes/Controller/LoginController.php, typo3/sysext/install/Classes/Service/EnableFileService.php
Commit date: 2023-11-14 09:57:56 +0100
Commit message: [SECURITY] Do not display full path to ENABLE_INSTALL_TOOL file

Using the Install Tool in composer mode, the login
displays a hint, where the ENABLE_INSTALL_TOOL file
must be placed to unlock the Install Tool.

This hint does not show the full path anymore.
Only the path relative to the project root is shown.

Resolves: #102242
Releases: main, 12.4
Change-Id: I1e9cbfe3ef7d4cc6af9635da71d0c7450fe44aa6
Security-Bulletin: TYPO3-CORE-SA-2023-005
Security-References: CVE-2023-47126
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81736
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Diff: diff --git a/typo3/sysext/install/Classes/Controller/LoginController.php b/typo3/sysext/install/Classes/Controller/LoginController.php
index 51fa29eca922..f8e8046aa82b 100644
--- a/typo3/sysext/install/Classes/Controller/LoginController.php
+++ b/typo3/sysext/install/Classes/Controller/LoginController.php
@@ -18,11 +18,10 @@ declare(strict_types=1);
 namespace TYPO3\CMS\Install\Controller;
 
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
 use TYPO3\CMS\Core\Configuration\ConfigurationManager;
-use TYPO3\CMS\Core\Core\Environment;
 use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;
 use TYPO3\CMS\Core\Http\JsonResponse;
 use TYPO3\CMS\Install\Service\EnableFileService;
 
 /**
@@ -40,12 +39,11 @@ class LoginController extends AbstractController
      * Render the "Create an "enable install tool file" action
      */
     public function showEnableInstallToolFileAction(ServerRequestInterface $request): ResponseInterface
     {
         $view = $this->initializeView($request);
-        $path = str_replace(Environment::getPublicPath() . '/', '', dirname(EnableFileService::getBestLocationForInstallToolEnableFile())) . '/';
-        $view->assign('enableInstallToolPath', $path);
+        $view->assign('enableInstallToolPath', EnableFileService::getStaticLocationForInstallToolEnableFileDirectory());
         return new JsonResponse([
             'success' => true,
             'html' => $view->render('Login/ShowEnableInstallToolFile'),
         ]);
     }
diff --git a/typo3/sysext/install/Classes/Service/EnableFileService.php b/typo3/sysext/install/Classes/Service/EnableFileService.php
index 458a0834382c..510f1b83ac9b 100644
--- a/typo3/sysext/install/Classes/Service/EnableFileService.php
+++ b/typo3/sysext/install/Classes/Service/EnableFileService.php
@@ -156,10 +156,19 @@ class EnableFileService
                 }
             }
         }
     }
 
+    /**
+     * Returns a static directory path that is suitable to be presented to
+     * unauthenticated visitors, in order to circumvent "Full Path Disclosure" issues.
+     */
+    public static function getStaticLocationForInstallToolEnableFileDirectory(): string
+    {
+        return Environment::isComposerMode() ? 'var/transient/' : 'typo3conf/';
+    }
+
     public static function getBestLocationForInstallToolEnableFile(): string
     {
         $possibleLocations = [
             'default' => Environment::getVarPath() . '/transient/' . self::INSTALL_TOOL_ENABLE_FILE_PATH,
             'permanent' => Environment::getConfigPath() . '/' . self::INSTALL_TOOL_ENABLE_FILE_PATH,

Vulnerable code: use TYPO3\CMS\Core\Core\Environment;
        $path = str_replace(Environment::getPublicPath() . '/', '', dirname(EnableFileService::getBestLocationForInstallToolEnableFile())) . '/';
        $view->assign('enableInstallToolPath', $path);
Fixed code:         $view->assign('enableInstallToolPath', EnableFileService::getStaticLocationForInstallToolEnableFileDirectory());
    /**
     * Returns a static directory path that is suitable to be presented to
     * unauthenticated visitors, in order to circumvent "Full Path Disclosure" issues.
     */
    public static function getStaticLocationForInstallToolEnableFileDirectory(): string
    {
        return Environment::isComposerMode() ? 'var/transient/' : 'typo3conf/';
    }