CVE-2022-23503: TYPO3 CMS vulnerable to Arbitrary Code Execution via Form Framework
7.5
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.32492%
CWE
Published
12/13/2022
Updated
1/30/2023
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| typo3/cms-core | composer | >= 8.0.0, < 8.7.49 | 8.7.49 |
| typo3/cms-core | composer | >= 9.0.0, < 9.5.38 | 9.5.38 |
| typo3/cms-core | composer | >= 10.0.0, < 10.4.33 | 10.4.33 |
| typo3/cms-core | composer | >= 11.0.0, < 11.5.20 | 11.5.20 |
| typo3/cms-core | composer | >= 12.0.0, < 12.1.1 | 12.1.1 |
| typo3/cms | composer | >= 10.0.0, < 10.4.33 | 10.4.33 |
| typo3/cms | composer | >= 11.0.0, < 11.5.20 | 11.5.20 |
| typo3/cms | composer | >= 12.0.0, < 12.1.1 | 12.1.1 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability occurs in functions handling form configuration merging and TypoScript resolution. Both functions were vulnerable because they processed user-controlled YAML data (form definitions) as executable TypoScript before proper separation of user input from internal configuration. The commit fixes show they were modified to resolve TypoScript in the override arrays BEFORE merging, rather than processing the merged result. This indicates the original implementation allowed user-submitted YAML containing TypoScript instructions (like _typoScriptNodeValue) to be evaluated as PHP code through the TypoScriptService::resolvePossibleTypoScriptConfiguration method.