CVE-2023-47126 (published 2023-11-14T20:15Z)

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions the login screen of the standalone install tool discloses the full path of the transient data directory (e.g. /var/www/html/var/transient/). This applies to composer-based scenarios only - “classic” non-composer installations are not affected. This issue has been addressed in version 12.4.8. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n

CVSS v3 base score: 5.3, MEDIUM (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/TYPO3/typo3
commit_details: repo_url: https://github.com/TYPO3/typo3
author: Markus Klein
author_date: 2023-11-14 09:57:53+01:00
msg: [SECURITY] Do not display full path to ENABLE_INSTALL_TOOL file

Using the Install Tool in composer mode, the login
displays a hint, where the ENABLE_INSTALL_TOOL file
must be placed to unlock the Install Tool.

This hint does not show the full path anymore.
Only the path relative to the project root is shown.

Resolves: #102242
Releases: main, 12.4
Change-Id: I1e9cbfe3ef7d4cc6af9635da71d0c7450fe44aa6
Security-Bulletin: TYPO3-CORE-SA-2023-005
Security-References: CVE-2023-47126
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/81736
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
repository: repo_url: https://github.com/TYPO3/typo3
repo_name: TYPO3/typo3
description: The TYPO3 Core - Enterprise Content Management System. Synchronized mirror of https://review.typo3.org/q/project:Packages/TYPO3.CMS
repo_language: PHP
owner: TYPO3
file_changes: filename: LoginController.php
change_type: ModificationType.MODIFY
diff: @@ -20,7 +20,6 @@ namespace TYPO3\CMS\Install\Controller;
 use Psr\Http\Message\ResponseInterface;
 use Psr\Http\Message\ServerRequestInterface;
 use TYPO3\CMS\Core\Configuration\ConfigurationManager;
-use TYPO3\CMS\Core\Core\Environment;
 use TYPO3\CMS\Core\FormProtection\FormProtectionFactory;
 use TYPO3\CMS\Core\Http\JsonResponse;
 use TYPO3\CMS\Install\Service\EnableFileService;
@@ -42,8 +41,7 @@ class LoginController extends AbstractController
     public function showEnableInstallToolFileAction(ServerRequestInterface $request): ResponseInterface
     {
         $view = $this->initializeView($request);
-        $path = str_replace(Environment::getPublicPath() . '/', '', dirname(EnableFileService::getBestLocationForInstallToolEnableFile())) . '/';
-        $view->assign('enableInstallToolPath', $path);
+        $view->assign('enableInstallToolPath', EnableFileService::getStaticLocationForInstallToolEnableFileDirectory());
         return new JsonResponse([
             'success' => true,
             'html' => $view->render('Login/ShowEnableInstallToolFile'),

programming_language: PHP
filename: EnableFileService.php
change_type: ModificationType.MODIFY
diff: @@ -158,6 +158,15 @@ class EnableFileService
         }
     }
 
+    /**
+     * Returns a static directory path that is suitable to be presented to
+     * unauthenticated visitors, in order to circumvent "Full Path Disclosure" issues.
+     */
+    public static function getStaticLocationForInstallToolEnableFileDirectory(): string
+    {
+        return Environment::isComposerMode() ? 'var/transient/' : 'typo3conf/';
+    }
+
     public static function getBestLocationForInstallToolEnableFile(): string
     {
         $possibleLocations = [

programming_language: PHP