CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
HIGH
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
AI Score
Confidence
High
EPSS
Percentile
19.8%
# Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)
# Date: Apr 9, 2023
# Exploit Author: Saeed reza Zamanian
# Software Link: https://get.typo3.org/release-notes/11.5.24
# Version: 11.5.24
# Tested on: Kali 2022.3
# CVE : CVE-2023-30451
In TYPO3 11.5.24, the filelist component allows attackers (with access to the administrator panel),
to read arbitrary files by utilizing a directory traversal via the baseuri field, This is demonstrated through :
POST /typo3/record/edit with ../../../ and the parameter
data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
-----------------------------------------------------
To exploit this vulnerability, follow these steps:
1. Log in to the administrator panel.
2. Navigate to 'file' > 'Filelist' section.
3. Right-click on a file storage and select 'New.'
4. Set the base URI to "../../../" and save.
After creating the file storage, the final HTTP request should resemble the one below. Once the file storage is created, refresh the page, enabling you to browse any directory on the server.
To access "/etc/passwd," browse to the '/etc/' directory, search for 'passwd,' and view the file.