CVE-2019-11831
📋 TL;DR
This vulnerability in PharStreamWrapper allows attackers to bypass directory traversal protections in TYPO3's phar:// stream wrapper. By using specially crafted URLs like phar:///path/bad.phar/../good.phar, attackers can circumvent deserialization safeguards, potentially leading to remote code execution. This affects TYPO3 installations using vulnerable versions of the phar-stream-wrapper package.
💻 Affected Systems
- TYPO3 CMS
- TYPO3 phar-stream-wrapper package
📦 What is this software?
Drupal by Drupal
Drupal by Drupal
Drupal by Drupal
Fedora by Fedoraproject
Fedora by Fedoraproject
Fedora by Fedoraproject
Joomla\! by Joomla
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Arbitrary file read/write, privilege escalation, or deserialization attacks leading to application compromise.
If Mitigated
Limited impact with proper input validation and file system permissions in place.
🎯 Exploit Status
Proof of concept demonstrated in advisory; exploitation requires ability to upload or reference phar files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: phar-stream-wrapper v2.1.1 or v3.1.1
Vendor Advisory: https://github.com/TYPO3/phar-stream-wrapper/releases
Restart Required: No
Instructions:
1. Update phar-stream-wrapper package to v2.1.1 (for 2.x) or v3.1.1 (for 3.x). 2. Update TYPO3 CMS if it bundles the vulnerable package. 3. Verify no regressions in phar:// stream functionality.
🔧 Temporary Workarounds
Disable phar:// wrapper
allTemporarily disable the phar:// stream wrapper in PHP configuration
php -d phar.readonly=1
Add 'phar.readonly = 1' to php.ini
Input validation filter
allImplement strict input validation to reject phar:// URLs with directory traversal patterns
🧯 If You Can't Patch
- Implement web application firewall rules to block phar:// URLs with traversal sequences
- Restrict file upload capabilities and monitor for suspicious phar file usage
🔍 How to Verify
Check if Vulnerable:
Check composer.json or package version: composer show typo3/phar-stream-wrapperCheck Version:
composer show typo3/phar-stream-wrapper | grep versionVerify Fix Applied:
Verify installed version is 2.1.1+ or 3.1.1+: composer show typo3/phar-stream-wrapper | grep version📡 Detection & Monitoring
Log Indicators:
- phar:// URLs with ../ sequences in access logs
- Unexpected file operations via phar wrapper
Network Indicators:
- HTTP requests containing phar:// paths with traversal patterns
SIEM Query:
web_access_logs WHERE url CONTAINS 'phar://' AND url CONTAINS '../'🔗 References
- http://www.securityfocus.com/bid/108302
- https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1
- https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1
- https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/
- https://seclists.org/bugtraq/2019/May/36
- https://typo3.org/security/advisory/typo3-psa-2019-007/
- https://www.debian.org/security/2019/dsa-4445
- https://www.drupal.org/sa-core-2019-007
- https://www.synology.com/security/advisory/Synology_SA_19_22
- http://www.securityfocus.com/bid/108302
- https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v2.1.1
- https://github.com/TYPO3/phar-stream-wrapper/releases/tag/v3.1.1
- https://lists.debian.org/debian-lts-announce/2019/05/msg00029.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/65ODQHDHWR74L6TCAPAQR5FQHG6MCXAW/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QDJVUJPUW3RZ4746SC6BX4F4T6ZXNBH/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/AUEXS4HRI4XZ2DTZMWAVQBYBTFSJ34AR/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E3NUKPG7V4QEM6QXRMHYR4ABFMW5MM2P/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U6JX7WR6DPMKCZQP7EYFACYXSGJ3K523/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Z246UWBXBEKTQUDTLRJTC7XYBIO4IBE4/
- https://seclists.org/bugtraq/2019/May/36
- https://typo3.org/security/advisory/typo3-psa-2019-007/
- https://www.debian.org/security/2019/dsa-4445
- https://www.drupal.org/sa-core-2019-007
- https://www.synology.com/security/advisory/Synology_SA_19_22
