TYPO3 Core

Did not manage yet to test it with extensions.typo3.dev (it does not accept files).
In case description and other meta-data is passed as is via TER upload → extensions.xml → local XML import, this is a severe XSS vulnerability effecting all TYPO3 sites.

https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:N/E:H/RL:O/RC:C&version=3.1 (7.8, high)

I tested it by changing the data directly in the database. I guess, that there is no filter in the upload process.

Did not manage to exploit this via upload:

    <version version="9.9.0">
      <title>The Official TYPO3 Cross-Site Scripting Package</title>
      <description>This package provides XSS by using scriptalert(12345)/script</description>
      <state>stable</state>
      <reviewstate>0</reviewstate>
      <category>distribution</category>
    ...
    <version version="9.9.1">
      <title>The Official TYPO3 Cross-Site Scripting Package</title>
      <description>&amp;lt;script&amp;gt;alert(2)&amp;lt;/script&amp;gt; ![CDATA[scriptalert(12345)/script &amp;lt;script&amp;gt;alert(3)&amp;lt;/script&amp;gt;]]</description>
      <state>stable</state>
      <reviewstate>0</reviewstate>
      <category>distribution</category>

• ext_emconf.php has not been sanitized/modied
• but the creation of extensions.xml used a corresponding sanitization,
  at least since January 2017 (I did not track earlier changes in other locations), see https://git.typo3.org/services/t3o-sites/extensions.typo3.org/ter/-/blame/c755d1df7b9e7cd41d969e14bc8e66077f7c753a/html/typo3conf/ext/ter/class.tx_ter_helper.php?page=1#L527-533

I am OK with fixing it in public.

The sanitizer looks a bit weird, I think there are better ways to handle XML or data in XML, but your test proves that no vector exists, so let's fix it public.

Since the issue can not be exploited using the TER extension upload, a fix in public is also OK for me.