Project

General

Profile

Actions
Copy link

Bug #97930

closed

Harden distribution overview in extension manager

Added by Frank Nägler over 2 years ago. Updated about 1 month ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
Security
Target version:
-
Start date:
2022-07-13
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
9
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

The distribution overview page is vulnerable for XSS.

If a distribution description contains XSS within the first 150 characters, the overview execute the code.

File: EXT:extensionmanager/Resources/Private/Partials/List/Distribution.html

Affected code: {distribution.description -> f:format.crop(maxCharacters: 150) -> f:format.raw()}

Reproduce: inject the code <script>alert('XSS');</script> to the description of an extension / distribution and open the overview.

Files

exteions.xml.gz.png (78.4 KB) exteions.xml.gz.png Oliver Hader, 2022-07-25 11:10

Related issues 1 (0 open — 1 closed)

Related to TYPO3 Core - Task #82000: Use new card layout for distributions list viewClosedMarkus Sommer2017-07-28

Actions
Actions
Copy link
 #1

Updated by Oliver Hader over 2 years ago

  • Reporter set to Frank Nägler
Actions
Copy link
 #2

Updated by Oliver Hader over 2 years ago

  • Affected Version set to 9.0, 10, 11
Actions
Copy link
 #3

Updated by Oliver Hader over 2 years ago

  • Related to Task #82000: Use new card layout for distributions list view added
Actions
Copy link
 #4

Updated by Oliver Hader over 2 years ago

  • TYPO3 Version changed from 12 to 9
Actions
Copy link
 #5

Updated by Oliver Hader over 2 years ago

Did not manage yet to test it with extensions.typo3.dev (it does not accept files).
In case description and other meta-data is passed as is via TER upload → extensions.xml → local XML import, this is a severe XSS vulnerability effecting all TYPO3 sites.

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N/E:H/RL:O/RC:C&version=3.1 (7.8, high)

Actions
Copy link
 #6

Updated by Frank Nägler over 2 years ago

I tested it by changing the data directly in the database. I guess, that there is no filter in the upload process.

Actions
Copy link
 #7

Updated by Oliver Hader over 2 years ago

extenions.xml.gz contents are imported as is into the database → XSS confirmed for that part of the vector.
The missing piece is still how the TER handles/sanitizes uploaded data.

Actions
Copy link
 #8

Updated by Oliver Hader over 2 years ago

  • Priority changed from Should have to Must have
Actions
Copy link
 #9

Updated by Oliver Hader over 2 years ago

  • Target version set to Release February 2024
Actions
Copy link
 #10

Updated by Oliver Hader about 2 years ago

Did not manage to exploit this via upload:

    <version version="9.9.0">
      <title>The Official TYPO3 Cross-Site Scripting Package</title>
      <description>This package provides XSS by using scriptalert(12345)/script</description>
      <state>stable</state>
      <reviewstate>0</reviewstate>
      <category>distribution</category>
    ...
    <version version="9.9.1">
      <title>The Official TYPO3 Cross-Site Scripting Package</title>
      <description>&amp;lt;script&amp;gt;alert(2)&amp;lt;/script&amp;gt; ![CDATA[scriptalert(12345)/script &amp;lt;script&amp;gt;alert(3)&amp;lt;/script&amp;gt;]]</description>
      <state>stable</state>
      <reviewstate>0</reviewstate>
      <category>distribution</category>
Actions
Copy link
 #11

Updated by Oliver Hader about 2 years ago

  • Status changed from Accepted to Needs Feedback
  • Priority changed from Must have to Should have

After analyzing the behavior of the actual TER, I don't see a real attack vector anymore. I'd opt for fixing this in public, what do you think?

Actions
Copy link
 #12

Updated by Frank Nägler about 2 years ago

I am OK with fixing it in public.

The sanitizer looks a bit weird, I think there are better ways to handle XML or data in XML, but your test proves that no vector exists, so let's fix it public.

Actions
Copy link
 #13

Updated by Torben Hansen about 2 years ago

Since the issue can not be exploited using the TER extension upload, a fix in public is also OK for me.

Actions
Copy link
 #14

Updated by Oliver Hader about 2 years ago

  • Target version changed from Release February 2024 to public
Actions
Copy link
 #15

Updated by Oliver Hader about 2 years ago

  • Project changed from 1716 to TYPO3 Core
  • Subject changed from XSS in distribution overview to Harden distribution overview in extension manager
  • Category changed from OW-A07: Cross Site Scripting to Security
  • Target version deleted (public)
  • Reporter deleted (Frank Nägler)
  • Affected Version deleted (9.0, 10, 11)

→ moved from security tracker to public core tracker

Actions
Copy link
 #16

Updated by Gerrit Code Review 4 months ago

  • Status changed from Needs Feedback to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85260

Actions
Copy link
 #17

Updated by Gerrit Code Review 4 months ago

Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85203

Actions
Copy link
 #18

Updated by Georg Ringer 4 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions
Copy link
 #19

Updated by Gerrit Code Review 4 months ago

  • Status changed from Resolved to Under Review

Patch set 2 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/85203

Actions
Copy link
 #20

Updated by Georg Ringer 4 months ago

  • Status changed from Under Review to Resolved
Actions
Copy link
 #21

Updated by Benni Mack about 1 month ago

  • Status changed from Resolved to Closed
Actions
Copy link

Also available in: Atom PDF