Miggo Logo
Miggo Vulnerability Database
→
GHSA-8h4m-r4wm-xj7r

GHSA-8h4m-r4wm-xj7r: TYPO3 Arbitrary Code Execution via File List Module

8.8

CVSS Score
3.1

Basic Information

CVE ID
-
GHSA ID
GHSA-8h4m-r4wm-xj7r
EPSS Score
-
CWE
CWE-434
Published
6/7/2024
Updated
6/7/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
typo3/cmscomposer>= 8.0.0, < 8.7.238.7.23
typo3/cmscomposer>= 9.0.0, < 9.5.49.5.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from an incomplete file deny pattern in TYPO3's configuration. The SystemEnvironmentBuilder::defineBaseConstants() method is directly responsible for setting the FILE_DENY_PATTERN_DEFAULT constant, which governs restricted file types. The commit patching this vulnerability explicitly modifies this function to add the missing extensions. Since this function controls the security-critical deny pattern configuration, its outdated implementation in vulnerable versions is the root cause enabling unsafe file uploads.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*u* to missin* *il* *xt*nsions in $*LO**LS['TYPO*_*ON*_V*RS']['**'][‘*il***nyP*tt*rn’], ***k*n* us*rs *r* *llow** to uplo** *.p**r, *.s*tml, *.pl or *.**i *il*s w*i** **n ** *x**ut** in **rt*in w** s*rv*r s*tups. * v*li* ***k*n* us*r ***ount is n****

Reasoning

T** vuln*r**ility st*ms *rom *n in*ompl*t* *il* **ny p*tt*rn in TYPO*'s *on*i*ur*tion. T** Syst*m*nvironm*nt*uil**r::***in***s**onst*nts() m*t*o* is *ir**tly r*sponsi*l* *or s*ttin* t** *IL*_**NY_P*TT*RN_****ULT *onst*nt, w*i** *ov*rns r*stri*t** *il