CVE-2022-31046 (PHP, published 2022-06-14T21:15Z)
Description: value: TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.
Severity: MEDIUM (CVSS v3 base score: 4.3)
Weakness: CWE-319 \u2014 Cleartext Transmission of Sensitive Information
The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.
Repository: https://github.com/TYPO3/typo3
Files changed:
typo3/sysext/core/Classes/Authentication/BackendUserAuthentication.php
typo3/sysext/core/Classes/Resource/Filter/ImportExportFilter.php
typo3/sysext/core/Classes/Resource/ResourceStorage.php
typo3/sysext/core/Tests/Acceptance/Application/Impexp/UsersCest.php
typo3/sysext/core/Tests/Functional/Authentication/BackendUserAuthenticationTest.php
typo3/sysext/impexp/Classes/ContextMenu/ItemProvider.php
typo3/sysext/impexp/Classes/Controller/ExportController.php
typo3/sysext/impexp/Classes/Controller/ImportController.php
typo3/sysext/reports/Classes/Report/Status/SecurityStatus.php
typo3/sysext/reports/Resources/Private/Language/locallang_reports.xlf
Commit message: [SECURITY] Restrict export functionality to allowed users

The import functionality of the import/export module is already
restricted to admin users or users, who explicitly have access through
the user TSConfig setting "options.impexp.enableImportForNonAdminUser".

The export functionality has the following security drawbacks:

* Export for editors is not limited on field level
* The "Save to filename" functionality saves to a shared folder, which
  other editors with different access rights may have access to.

Both issues are not easy to resolve and also the target audience for
the Import/Export functionality are mainly TYPO3 admins.

Therefore, now also the export functionality is restricted to TYPO3
admin users and to users, who explicitly have access through the new
user TSConfig setting "options.impexp.enableExportForNonAdminUser".

Additionally, the contents of the temporary "importexport" folder in
file storages is now only visible to users who have access to the
export functionality.

In general, it is recommended to only install the Import/Export
extension when the functionality is required.

Resolves: #94951
Releases: main, 11.5, 10.4
Change-Id: Iae020baf051aeec0613366687aa8ebcbf9b3d8b2
Security-Bulletin: TYPO3-CORE-SA-2022-001
Security-References: CVE-2022-31046
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74902
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Vulnerable code:
        return $this->fileAndFolderNameFilters;
        $filters = $useFilters == true ? $this->fileAndFolderNameFilters : [];
        $filters = $useFilters == true ? $this->fileAndFolderNameFilters : [];
        $filters = $useFilters ? $this->fileAndFolderNameFilters : [];
        $filters = $useFilters == true ? $this->fileAndFolderNameFilters : [];
        $filters = $useFilters == true ? $this->fileAndFolderNameFilters : [];
        $filters = $useFilters ? $this->fileAndFolderNameFilters : [];
    public function doNotShowImportInContextMenuForNonAdminUser(ApplicationTester $I, PageTree $pageTree): void
        $I->seeElement($this->contextMenuExport);
    public function showImportInContextMenuForNonAdminUserIfFlagSet(ApplicationTester $I): void
        $this->setUserTsConfig($I, 2, 'options.impexp.enableImportForNonAdminUser = 1');
        $I->seeElement($this->contextMenuExport);
                $canRender = true;
                $canRender = $this->table === 'pages' && $this->isImportEnabled();

    /**
     * Check if import functionality is available for current user
     */
    protected function isImportEnabled(): bool
    {
        return $this->backendUser->isAdmin()
            || (bool)($this->backendUser->getTSConfig()['options.']['impexp.']['enableImportForNonAdminUser'] ?? false);
    }
        if (!$this->isImportEnabled()) {
    /**
     * Check if import functionality is available for current user.
     */
    protected function isImportEnabled(): bool
    {
        $backendUser = $this->getBackendUser();
        return $backendUser->isAdmin() || ($backendUser->getTSConfig()['options.']['impexp.']['enableImportForNonAdminUser'] ?? false);
    }


Fixed code:

    /**
     * Returns if import functionality is available for current user
     *
     * @internal
     */
    public function isImportEnabled(): bool
    {
        return $this->isAdmin()
            || ($this->getTSConfig()['options.']['impexp.']['enableImportForNonAdminUser'] ?? false);
    }

    /**
     * Returns if export functionality is available for current user
     *
     * @internal
     */
    public function isExportEnabled(): bool
    {
        return $this->isAdmin()
            || ($this->getTSConfig()['options.']['impexp.']['enableExportForNonAdminUser'] ?? false);
    }
<?php

declare(strict_types=1);

/*
 * This file is part of the TYPO3 CMS project.
 *
 * It is free software; you can redistribute it and/or modify it under
 * the terms of the GNU General Public License, either version 2
 * of the License, or any later version.
 *
 * For the full copyright and license information, please read the
 * LICENSE.txt file that was distributed with this source code.
 *
 * The TYPO3 project - inspiring people to share!
 */

namespace TYPO3\CMS\Core\Resource\Filter;

use TYPO3\CMS\Core\Authentication\BackendUserAuthentication;
use TYPO3\CMS\Core\Resource\Driver\DriverInterface;

/**
 * Utility methods for filtering filenames stored in `importexport` temporary folder.
 * Albeit this filter is in the scope of `ext:impexp`, it is located in `ext:core` to
 * apply filters on left-over fragments, even when `ext:impexp` is not installed.
 *
 * @internal
 */
class ImportExportFilter
{
    /**
     * Filter method that checks if a directory or a file in such directory belongs to the temp directory of EXT:impexp
     * and the user has "export" permissions.
     */
    public static function filterImportExportFilesAndFolders(string $itemName, string $itemIdentifier, string $parentIdentifier, array $additionalInformation, DriverInterface $driverInstance)
    {
        // + `_temp_` is hard-coded in `BackendUserAuthentication::getDefaultUploadTemporaryFolder()`
        // + `importexport` is hard-coded in `ImportExport::createDefaultImportExportFolder()`
        $importExportFolderSubPath = '/_temp_/importexport/';
        if (str_ends_with($parentIdentifier, $importExportFolderSubPath) || str_contains($itemIdentifier, $importExportFolderSubPath)) {
            $backendUser = self::getBackendUser();
            if ($backendUser === null || !$backendUser->isExportEnabled()) {
                return -1;
            }
        }

        return true;
    }

    protected static function getBackendUser(): ?BackendUserAuthentication
    {
        return $GLOBALS['BE_USER'] ?? null;
    }
}
use TYPO3\CMS\Core\Resource\Filter\ImportExportFilter;
    /**
     * Returns a filter for files generated by EXT:impexp
     *
     * @return array<int, ImportExportFilter|string>
     * @internal
     */
    public function getImportExportFilter(): array
    {
        $filter = GeneralUtility::makeInstance(ImportExportFilter::class);

        return [$filter, 'filterImportExportFilesAndFolders'];
    }

        return array_merge($this->fileAndFolderNameFilters, [$this->getImportExportFilter()]);
        $filters = $useFilters == true ? $this->getFileAndFolderNameFilters() : [];
        $filters = $useFilters == true ? $this->getFileAndFolderNameFilters() : [];
        $filters = $useFilters ? $this->getFileAndFolderNameFilters() : [];
        $filters = $useFilters == true ? $this->getFileAndFolderNameFilters() : [];
        $filters = $useFilters == true ? $this->getFileAndFolderNameFilters() : [];

        $filters = $useFilters ? $this->getFileAndFolderNameFilters() : [];
    public function doNotShowImportAndExportInContextMenuForNonAdminUser(ApplicationTester $I, PageTree $pageTree): void
        $I->dontSeeElement($this->contextMenuExport);
    public function showImportExportInContextMenuForNonAdminUserIfFlagSet(ApplicationTester $I): void
        $this->setUserTsConfig($I, 2, "options.impexp.enableImportForNonAdminUser = 1\noptions.impexp.enableExportForNonAdminUser = 1");
        $I->seeElement($this->contextMenuExport);

    public function isImportEnabledDataProvider(): array
    {
        return [
            'admin user' => [
                1,
                '',
                true,
            ],
            'editor user' => [
                2,
                '',
                false,
            ],
            'editor user - enableImportForNonAdminUser = 1' => [
                2,
                'options.impexp.enableImportForNonAdminUser = 1',
                true,
            ],
        ];
    }

    /**
     * @test
     * @dataProvider isImportEnabledDataProvider
     */
    public function isImportEnabledReturnsExpectedValues(int $userId, string $tsConfig, bool $expected): void
    {
        $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUserTSconfig'] = $tsConfig;

        $subject = $this->setUpBackendUser($userId);
        self::assertEquals($expected, $subject->isImportEnabled());
    }

    public function isExportEnabledDataProvider(): array
    {
        return [
            'admin user' => [
                1,
                '',
                true,
            ],
            'editor user' => [
                2,
                '',
                false,
            ],
            'editor user - enableExportForNonAdminUser = 1' => [
                2,
                'options.impexp.enableExportForNonAdminUser = 1',
                true,
            ],
        ];
    }

    /**
     * @test
     * @dataProvider isExportEnabledDataProvider
     */
    public function isExportEnabledReturnsExpectedValues(int $userId, string $tsConfig, bool $expected): void
    {
        $GLOBALS['TYPO3_CONF_VARS']['BE']['defaultUserTSconfig'] = $tsConfig;

        $subject = $this->setUpBackendUser($userId);
        self::assertEquals($expected, $subject->isExportEnabled());
    }
                $canRender = $this->backendUser->isExportEnabled();
                $canRender = $this->table === 'pages' && $this->backendUser->isImportEnabled();
        if ($this->getBackendUser()->isExportEnabled() === false) {
            throw new \RuntimeException(
                'Export module is disabled for non admin users and '
                . 'userTsConfig options.impexp.enableExportForNonAdminUser is not enabled.',
                1636901978
            );
        }

        if (!$this->getBackendUser()->isImportEnabled()) {
            'exportedFiles' => $this->getExportedFilesStatus(),
    protected function getExportedFilesStatus(): ReportStatus
    {
        $value = $this->getLanguageService()->getLL('status_ok');
        $message = '';
        $severity = ReportStatus::OK;

        $queryBuilder = GeneralUtility::makeInstance(ConnectionPool::class)->getQueryBuilderForTable('sys_file');
        $exportedFiles = $queryBuilder
            ->select('storage', 'identifier')
            ->from('sys_file')
            ->where(
                $queryBuilder->expr()->like(
                    'identifier',
                    $queryBuilder->createNamedParameter('%/_temp_/importexport/%')
                ),
                $queryBuilder->expr()->or(
                    $queryBuilder->expr()->like(
                        'identifier',
                        $queryBuilder->createNamedParameter('%.xml')
                    ),
                    $queryBuilder->expr()->like(
                        'identifier',
                        $queryBuilder->createNamedParameter('%.t3d')
                    )
                ),
            )
            ->executeQuery()
            ->fetchAllAssociative();

        if (count($exportedFiles) > 0) {
            $files = [];
            foreach ($exportedFiles as $exportedFile) {
                $files[] = '<li>' . htmlspecialchars($exportedFile['storage'] . ':' . $exportedFile['identifier']) . '</li>';
            }

            $value = $this->getLanguageService()->getLL('status_insecure');
            $severity = ReportStatus::WARNING;
            $message = $this->getLanguageService()->getLL('status_exportedFiles_warningMessage');
            $message .= '<ul>' . implode(PHP_EOL, $files) . '</ul>';
            $message .= $this->getLanguageService()->getLL('status_exportedFiles_warningRecommendation');
        }

        return GeneralUtility::makeInstance(ReportStatus::class, $this->getLanguageService()->getLL('status_exportedFiles'), $value, $message, $severity);
    }

			<trans-unit id="status_exportedFiles" resname="status_exportedFiles">
				<source>XML/T3D export files</source>
			</trans-unit>
			<trans-unit id="status_exportedFiles_warningMessage" resname="status_exportedFiles_warningMessage">
				<source>The following exported files where found:</source>
			</trans-unit>
			<trans-unit id="status_exportedFiles_warningRecommendation" resname="status_exportedFiles_warningRecommendation">
				<source>It is recommended to delete exported files to avoid possible disclosure of exported data to backend users with lower/different access rights than user(s) who originally created the export(s).</source>
			</trans-unit>