TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)

vendor:

TYPO3

by:

Saeed reza Zamanian

3.1

CVSS

MEDIUM

Path Traversal

CWE

Product Name: TYPO3

Affected Version From: 45423

Affected Version To: 45423

Patch Exists: YES

Related CWE: CVE-2023-30451

CPE: a:typo3:typo3:11.5.24

Metasploit:

Other Scripts:

Platforms Tested: Kali Linux 2022.3

2023

TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)

In TYPO3 11.5.24, there exists a path traversal vulnerability in the filelist component. Attackers, with access to the administrator panel, can exploit this vulnerability to read arbitrary files by using directory traversal via the baseuri field. An authenticated attacker can manipulate the base URI by sending a crafted POST request to /typo3/record/edit with specific parameters, ultimately allowing them to access sensitive files on the server.

Mitigation:

To mitigate this vulnerability, it is recommended to update TYPO3 to a patched version. Additionally, restrict access to the TYPO3 administrator panel to authorized personnel only.

Source

Exploit-DB raw data:

# Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)
# Date: Apr 9, 2023
# Exploit Author: Saeed reza Zamanian
# Software Link: https://get.typo3.org/release-notes/11.5.24
# Version: 11.5.24
# Tested on: Kali 2022.3
# CVE : CVE-2023-30451


 In TYPO3 11.5.24, the filelist component allows attackers (with access to the administrator panel),
 to read arbitrary files by utilizing a directory traversal via the baseuri field, This is demonstrated through :
 POST /typo3/record/edit with ../../../ and the parameter
  data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
  
-----------------------------------------------------
To exploit this vulnerability, follow these steps:

1. Log in to the administrator panel.
2. Navigate to 'file' > 'Filelist' section.
3. Right-click on a file storage and select 'New.'
4. Set the base URI to "../../../" and save.

After creating the file storage, the final HTTP request should resemble the one below. Once the file storage is created, refresh the page, enabling you to browse any directory on the server.

To access "/etc/passwd," browse to the '/etc/' directory, search for 'passwd,' and view the file.