CVE-2022-35628
📋 TL;DR
This CVE describes a SQL injection vulnerability in the lux extension for TYPO3 CMS. Attackers can execute arbitrary SQL commands through the extension's frontend forms, potentially compromising the database. All TYPO3 installations using vulnerable versions of the lux extension are affected.
💻 Affected Systems
- TYPO3 lux extension
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data manipulation, privilege escalation, and potential remote code execution through database functions.
Likely Case
Unauthorized data access, data manipulation, and potential privilege escalation within the TYPO3 application.
If Mitigated
Limited impact with proper input validation and database permissions, though SQL injection remains a critical vulnerability.
🎯 Exploit Status
SQL injection vulnerabilities are typically easy to exploit with automated tools. The advisory suggests exploitation through frontend forms.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: lux extension 17.6.1 or 24.0.2
Vendor Advisory: https://typo3.org/security/advisory/typo3-ext-sa-2022-014
Restart Required: No
Instructions:
1. Update the lux extension via TYPO3 Extension Manager or Composer. 2. For version 17.x: Update to 17.6.1. 3. For versions 18.x-24.x: Update to 24.0.2. 4. Clear TYPO3 caches after update.
🔧 Temporary Workarounds
Disable lux extension
allTemporarily disable the vulnerable lux extension until patching is possible
typo3cms extension:deactivate lux
Web Application Firewall
allImplement WAF rules to block SQL injection patterns in lux extension requests
🧯 If You Can't Patch
- Implement strict input validation and parameterized queries in custom code
- Restrict database user permissions to minimum required for the lux extension
🔍 How to Verify
Check if Vulnerable:
Check lux extension version in TYPO3 Extension Manager or via composer show innocead/luxCheck Version:
composer show innocead/lux | grep versionVerify Fix Applied:
Confirm lux extension version is 17.6.1 or 24.0.2 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts through lux forms
- Suspicious parameter values in TYPO3 access logs
Network Indicators:
- SQL injection payloads in HTTP POST requests to lux endpoints
- Unusual database connection patterns
SIEM Query:
web_requests WHERE url CONTAINS 'lux' AND (params CONTAINS 'UNION' OR params CONTAINS 'SELECT' OR params CONTAINS 'OR 1=1')