CVE-2019-16699
📋 TL;DR
This vulnerability in the sr_freecap TYPO3 extension allows unauthenticated attackers to execute arbitrary Extbase actions due to insufficient input sanitization, leading to remote code execution. It affects TYPO3 installations using sr_freecap extension versions 2.4.5 and below or 2.5.2 and below.
💻 Affected Systems
- TYPO3 CMS with sr_freecap extension
📦 What is this software?
Sr Freecap by Sr Freecap Project
Sr Freecap by Sr Freecap Project
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise allowing attackers to execute arbitrary code, steal data, install malware, or pivot to other systems.
Likely Case
Remote code execution leading to website defacement, data theft, or installation of backdoors.
If Mitigated
Limited impact if proper network segmentation and least privilege principles are implemented.
🎯 Exploit Status
Public exploit code exists and exploitation requires minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: sr_freecap extension versions 2.4.6 and 2.5.3
Vendor Advisory: https://typo3.org/security/advisory/typo3-ext-sa-2019-018/
Restart Required: No
Instructions:
1. Update sr_freecap extension to version 2.4.6 or 2.5.3 via TYPO3 Extension Manager. 2. Clear TYPO3 caches. 3. Verify extension is updated.
🔧 Temporary Workarounds
Disable sr_freecap extension
allTemporarily disable the vulnerable extension until patching is possible
typo3cms extension:deactivate sr_freecap
Apply input validation filter
allAdd custom input validation for Extbase actions
🧯 If You Can't Patch
- Disable sr_freecap extension immediately
- Implement WAF rules to block suspicious Extbase action requests
🔍 How to Verify
Check if Vulnerable:
Check TYPO3 Extension Manager for sr_freecap version. If version is ≤2.4.5 or ≤2.5.2, system is vulnerable.Check Version:
typo3cms extension:list | grep sr_freecapVerify Fix Applied:
Verify sr_freecap extension version is 2.4.6 or 2.5.3 in TYPO3 Extension Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual Extbase action requests
- POST requests to vulnerable sr_freecap endpoints
- Unexpected PHP execution in web logs
Network Indicators:
- HTTP requests containing malicious Extbase action parameters
- Outbound connections from web server to unknown IPs
SIEM Query:
web_logs WHERE (uri CONTAINS 'sr_freecap' AND (method = 'POST' OR params CONTAINS 'Extbase'))