Bug #33272: Persistent XSS in HTML content element through t3editor - TYPO3 Core - TYPO3 Forge

Custom queries

12 LTS
Accessibility
Dashboard issues
Easy tasks
Extbase Issues
FAL Issues
FAL Sprint 2023
Hierarchical Issues
Issues reported for v11
JavaScript issues
JavaScript Issues (w/o Epics/Stories)
Most wanted Bugfixes
Most wanted Features
My open issues
New & Unassigned
No feedback within 90 days
Open Bugs
Open issues of 10
Page Tree Regressions after 2020-07-28
Recently modified
Regressions
Stabilization Issues
Usability or UX

Actions

Copy link

Bug #33272

closed

Persistent XSS in HTML content element through t3editor

Added by Sara no-lastname-given over 12 years ago. Updated over 5 years ago.

Status:

Closed

Priority:

Must have

Assignee:

Category:

Target version:

Start date:

2012-01-17

Due date:

% Done:

Estimated time:

TYPO3 Version:

4.6

PHP Version:

5.3

Tags:

Complexity:

Is Regression:

Sprint Focus:

Description

The t3editor of the HTML content element is susceptible to XSS, as output is not escaped. This can lead to privilege escalation in the Backend.

By disabling the t3editor, you can enter code like this

</textarea><script>alert(1)</script>

Opening with t3editor enabled will then execute the JS.

Original report:

</textarea> triggers end of html content element in backend

Surely the html CE should be self-contained? Is there any way of turning this 'feature' off?

Also reported by Michael B. in #33252

Related issues 1 (0 open — 1 closed)

Is duplicate of TYPO3 Core - Bug #33651: closing textarea tag on html element in backend closes the textarea itself.

Closed

2012-02-03

Actions

Issue # Delay: days Cancel

History
Notes
Property changes

Actions

Copy link

Updated by Markus Klein over 12 years ago

Hi Sara,

I'm sorry, but I've absolutely no clue what this issue is about.
Please consider describing your problem more precisely.

Thank you.

Actions

Copy link

Updated by Steffen Gebert over 12 years ago

Project changed from TYPO3 Core to 1716

Actions

Copy link

Updated by Steffen Gebert over 12 years ago

Subject changed from </textarea> triggers end of html content element in backend to XSS in HTML content element through t3editor
Category set to OW-A07: Cross Site Scripting

It might be a problem on my side, but disabling the t3editor did not work for me. Is this feature defect?
If it's defect, either manually insert it into database or insert it in a 4.5 installation and then upgrade to 4.6+ ;-)

Actions

Copy link

Updated by Steffen Gebert over 12 years ago

Status changed from New to Closed

Resolved as duplicate

Actions

Copy link

Updated by Steffen Gebert over 12 years ago

Status changed from Closed to Accepted

Damn it.. didn't want to close both of the reports :-/

Actions

Copy link

Updated by Steffen Gebert over 12 years ago

Applies to 4.6+4.7

Actions

Copy link

Updated by Gerrit Code Review over 12 years ago

Status changed from Accepted to Under Review

Patch set 1 for branch master has been pushed to the review server.
It is available at http://review.typo3.org/8761

Actions

Copy link

Updated by Gerrit Code Review over 12 years ago

Patch set 1 for branch TYPO3_4-6 has been pushed to the review server.
It is available at http://review.typo3.org/8762

Actions

Copy link

Updated by Steffen Gebert over 12 years ago

Subject changed from XSS in HTML content element through t3editor to Persistent XSS in HTML content element through t3editor

Actions

Copy link

#10

Updated by Helmut Hummel over 12 years ago

Hi,

I think that the HTML content element should NEVER be available for editors, because by definition being able to edit plain HTML leads to persitent XSS.

That said, I'm fine with fixing that publicly.

Actions

Copy link

#11

Updated by Steffen Gebert over 12 years ago

Fine, will take care of it.

Actions

Copy link

#12

Updated by Helmut Hummel almost 12 years ago

Project changed from 1716 to TYPO3 Core
Category deleted (~~OW-A07: Cross Site Scripting~~)

Actions

Copy link

#13

Updated by Steffen Gebert almost 12 years ago

I guess you discussed that, would you share your opinion, why this is no security issue? Because HTML CE is treated bad generally?

As soon as an editor has access to the HTML CE, the persistent XSS is IMHO nothing desirable.

Actions

Copy link

#14

Updated by Steffen Gebert over 11 years ago

This is not a critical issue, as editors, which can use the HTML CE still have the possibility to put JS into Frontend code. Giving this possibility also for the Backend is no additional security issue.

So this is just a bug fix.

Actions

Copy link

#15