CVE-2024-25121
📋 TL;DR
This vulnerability in TYPO3 allows authenticated backend users to access files in the fallback storage via the File Abstraction Layer, potentially exposing sensitive file names and contents. It affects TYPO3 installations with backend user accounts and improperly configured file storages. The risk is limited to authenticated users but could lead to information disclosure.
💻 Affected Systems
- TYPO3 CMS
📦 What is this software?
Typo3 by Typo3
Typo3 by Typo3
Typo3 by Typo3
Typo3 by Typo3
Typo3 by Typo3
Typo3 by Typo3
⚠️ Risk & Real-World Impact
Worst Case
Authenticated attackers could retrieve sensitive files from the web root directory, potentially exposing configuration files, credentials, or other confidential data.
Likely Case
Authenticated users with malicious intent could access files they shouldn't have permission to view, leading to information disclosure.
If Mitigated
With proper access controls and file storage configurations, the impact is minimal as it requires authenticated backend access.
🎯 Exploit Status
Exploitation requires authenticated backend access and knowledge of the DataHandler interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, or 13.0.1
Vendor Advisory: https://typo3.org/security/advisory/typo3-core-sa-2024-006
Restart Required: No
Instructions:
1. Backup your TYPO3 installation and database. 2. Update TYPO3 to the patched version for your branch. 3. Clear all caches via the TYPO3 backend. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict backend user permissions
allLimit backend user access to only necessary functions and modules, particularly DataHandler operations.
Configure proper file storages
allEnsure all files are stored in properly configured file storages rather than relying on fallback storage.
🧯 If You Can't Patch
- Implement strict access controls for backend user accounts
- Monitor DataHandler operations and file access logs for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check TYPO3 version in the backend under 'Admin Tools > System Information' or via composer show typo3/cms-coreCheck Version:
composer show typo3/cms-core | grep versionVerify Fix Applied:
Verify the installed version matches or exceeds the patched versions listed in the advisory📡 Detection & Monitoring
Log Indicators:
- Unusual DataHandler operations on sys_file entities
- Access attempts to files in fallback storage
Network Indicators:
- Unusual backend user activity patterns
SIEM Query:
source="typo3.log" AND ("DataHandler" AND "sys_file")