TYPO3 CMS Form Framework SQL Injection and Privilege Escalation Vulnerability (TYPO3-CORE-SA-2018-003)

Vulnerability Overview Vulnerability ID: TYPO3-CORE-SA-2018-003 Vulnerability Type: Privilege Escalation & SQL Injection Description: The TYPO3 CMS Form Framework (system extension "form") contains SQL injection and privilege escalation vulnerabilities. Specifically, system-related configurations in user-generated configurations were not properly separated, allowing form definition files to be persisted to form definition files that were not configured for modification. This applies to definitions managed via the Form Editor module as well as files uploaded directly using the regular file list module. Exploitation requires a valid backend user account and the Form system extension to be activated. Affected Versions Affected Versions: 8.5.0 to 8.7.16 and 9.0.0 to 9.3.0 Severity: High CVSS Score: AV:N/AC:M/Au:S/C:C/I:C/E:H/W:R/RC:C Remediation 1. Update to a Fixed Version: Upgrade to TYPO3 versions 8.7.17 or 9.3.1 to resolve the aforementioned issues. 2. File Suffix Change: To distinguish form definition files from standard YAML files, a new file suffix ".form.yaml" has been introduced. Form definition files provided by TYPO3 extensions must be renamed to use this new suffix (e.g., "Contact.yaml" becomes "Contact.form.yaml"). The new upgrade wizard will rename affected resources and update references within content elements. Recommended Migration Path Ensure the reference index is up to date (see documentation). Update to the mentioned TYPO3 versions to fix the described issues. Manually rename form definition files in extensions to use the ".form.yaml" suffix (files retaining only the ".yaml" suffix can still be referenced and rendered in the frontend). Execute the "Rename form definition file extension from .yaml to .form.yaml" upgrade wizard in the TYPO3 Install Tool. Additional Information Publication Date: July 12, 2018 Reporter: Oliver Hader Fixers: Susanne Moog and Ralf Zimmermann General Recommendations Follow the recommendations outlined in the TYPO3 security guidelines and subscribe to the TYPO3 announcements mailing list. General Notes All code changes related to security are tagged to facilitate easy identification during code review. Author Information Oliver Hader: TYPO3 core developer, has been using TYPO3 since 2005 and became a member of the TYPO3 core team in 2007. Returned to university in 2014 to pursue a Master's degree in Internet Network Science, currently researching advanced web technology topics, particularly TYPO3. In his spare time, he enjoys cycling. --- End of Summary

Goal Reached Thanks to every supporter — we hit 100%!

TYPO3 CMS Form Framework SQL Injection and Privilege Escalation Vulnerability (TYPO3-CORE-SA-2018-003)