Typo3 Arbitrary Code Execution and Cross-Site Scripting in Backend API
Date: 2024-06
Affected: composer/typo3/cms, composer/typo3/cms
Attack vector: path-traversal
Category: vulnerability-disclosure
Severity: High
CWE: CWE-22
CWE-79
CVSS:  (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)

Backend API configuration using Page TSconfig is vulnerable to arbitrary code execution and cross-site scripting. TSconfig fields of page properties in backend forms can be used to inject malicious sequences. Field tsconfig_includes is vulnerable to directory traversal leading to same scenarios as having direct access to TSconfig settings. A valid backend user account having access to modify values for fields pages.TSconfig and pages.tsconfig_includes is needed in order to exploit this vulnerability.


Mitigations:

Architectural layers (MAESTRO):