TYPO3 11.5.24 Path Traversal Vulnerability

2023-12-2000:00:00

Saeed reza Zamanian

0day.today

180

typo3

path traversal

vulnerability

filelist component

administrator panel

directory traversal

exploit

http request

file storage

4.9 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

20.0%

JSON

# Exploit Title: TYPO3 11.5.24 Path Traversal Vulnerability (Authenticated)
# Exploit Author: Saeed reza Zamanian
# Software Link: https://get.typo3.org/release-notes/11.5.24
# Version: 11.5.24
# Tested on: Kali 2022.3
# CVE : CVE-2023-30451


 In TYPO3 11.5.24, the filelist component allows attackers (with access to the administrator panel),
 to read arbitrary files by utilizing a directory traversal via the baseuri field, This is demonstrated through :
 POST /typo3/record/edit with ../../../ and the parameter
  data[sys_file_storage]*[data][sDEF][lDEF][basePath][vDEF].
  
-----------------------------------------------------
To exploit this vulnerability, follow these steps:

1. Log in to the administrator panel.
2. Navigate to 'file' > 'Filelist' section.
3. Right-click on a file storage and select 'New.'
4. Set the base URI to "../../../" and save.

After creating the file storage, the final HTTP request should resemble the one below. Once the file storage is created, refresh the page, enabling you to browse any directory on the server.

To access "/etc/passwd," browse to the '/etc/' directory, search for 'passwd,' and view the file.