Miggo Logo
Book a Demo
Miggo Vulnerability Database
→
CVE-2024-34357

CVE-2024-34357:
TYPO3 vulnerable to Cross-Site Scripting in the ShowImageController

5.4

CVSS Score

Basic Information

CVE ID
CVE-2024-34357
GHSA ID
GHSA-hw6c-6gwq-3m3m
EPSS Score
-
CWE
CWE-79
Published
5/14/2024
Updated
5/14/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
typo3/cms-corecomposer>= 9.0.0, <= 9.5.479.5.48
typo3/cms-corecomposer>= 10.0.0, <= 10.4.4410.4.45
typo3/cms-corecomposer>= 11.0.0, <= 11.5.3611.5.37
typo3/cms-corecomposer>= 12.0.0, <= 12.4.1412.4.15
typo3/cms-corecomposer>= 13.0.0, <= 13.1.013.1.1

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stemmed from three unencoded outputs in ShowImageController:

  1. $processedImage->getProperty('width') used in ###width### placeholder
  2. $processedImage->getProperty('height') used in ###height### placeholder
  3. $this->file->getProperty('title') used in ###TITLE### marker

The commit 3764749 added htmlspecialchars() to all these locations, confirming they were unsafe raw outputs. The XSS vulnerability occurred because an attacker with backend access could store malicious payloads in file metadata properties, which would render unescaped in the frontend via the tx_cms_showpic endpoint.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Pro*l*m **ilin* to prop*rly *n*o** us*r-*ontroll** v*lu*s in *il* *ntiti*s, t** `S*owIm****ontroll*r` (_*I* tx_*ms_s*owpi*_) is vuln*r**l* to *ross-sit* s*riptin*. *xploitin* t*is vuln*r**ility r*quir*s * v*li* ***k*n* us*r ***ount wit* ****ss to

Reasoning

T** vuln*r**ility st*mm** *rom t*r** un*n*o*** outputs in S*owIm****ontroll*r: *. $pro**ss**Im***->**tProp*rty('wi*t*') us** in ###wi*t*### pl****ol**r *. $pro**ss**Im***->**tProp*rty('**i**t') us** in ###**i**t### pl****ol**r *. $t*is->*il*->**tProp