Bug #19523: Crossite scripting vulnerability in Core ext. felogin - TYPO3 Core - TYPO3 Forge

Actions

Copy link

Bug #19523

closed

Crossite scripting vulnerability in Core ext. felogin

Added by Dirk Hoffmann over 15 years ago. Updated about 7 years ago.

Status:

Closed

Priority:

Should have

Assignee:

Ingo Renner

Category:

Target version:

Start date:

2008-10-29

Due date:

% Done:

Estimated time:

TYPO3 Version:

4.2

PHP Version:

4.3

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

The redirect_url parameter in felogin extension is not filtered by htmlspecialchars.

I have test this on a fresh installed Tzpo3 4.2.2 without anz third partz extensions.
Simple create a loginform and call the login page e.g with this url:

http://www.somedomain.tld/index.php?id=login&redirect_url=%22%3e%3cSCRIPT%3ealert('Paros')%3c/SCRIPT%3e%3cspan%20%22

"login" is the alias of the login page

Note: In some cases the server configuration can prevent this isue.
(issue imported from #M9673)

Files

Download all files

felogin.patch (622 Bytes) felogin.patch		Administrator Admin, 2008-10-29 17:22
9673.diff (1.19 KB) 9673.diff		Administrator Admin, 2008-10-30 09:24
0009673_rev4386.diff (1.24 KB) 0009673_rev4386.diff		Administrator Admin, 2008-10-30 16:35

Actions

Copy link

Updated by Dirk Hoffmann over 15 years ago

Correction:
PHP Version on Testsystem is 5.2

Actions

Copy link

Updated by Dirk Hoffmann over 15 years ago

Thanks to Matthias Humbert to.

Actions

Copy link

Updated by Marcus Krause over 15 years ago

This will be handled by TYPO3 Security Team from now on.

Marcus.

Actions

Copy link

Updated by Dmitry Dulepov over 15 years ago

Logout is also vulnerable for the issue. I attach a different patch that solves the problem for both login and logout.

Actions

Copy link

Updated by Marcus Krause over 15 years ago

Thanks Dmitry!

Actions

Copy link

Updated by Marcus Krause over 15 years ago

Issue confirmed for 4.2.0, 4.2.1, 4.2.2

mentioned additional logout vulnerability confirmed for 4.2.2

Actions

Copy link

Updated by Marcus Krause over 15 years ago

added patch that could be successfully applied to current rb42 revision (as 2nd hunk of Dmitry's patch will fail due to outdated working copy)
modifications are the same like in Dmitry's one

credits go to Dmitry! ;-)

Actions

Copy link

Updated by Ingo Renner over 15 years ago

thanks Dmitry!

Actions

Copy link

Updated by Steffen Kamper over 15 years ago

thanks from me too!

I integrated that in #9681, did a version for 4.2 and will declare this as cleaning up to CGL (which i did, missing spaces) and a forgotten HSC that can destroy HTML output.

Actions

Copy link

#10