Information Disclosure due to Out-of-scope Site Resolution
Published 25 Jul 2023 · Updated 16 Feb 2024
Affected packages
- Affected
- >=9.4.0 <9.5.42
- Fixed in
- 9.5.42
composer require typo3/cms-core:^9.5.42- Affected
- >=10.0.0 <10.4.39
- Fixed in
- 10.4.39
composer require typo3/cms-core:^10.4.39- Affected
- >=11.0.0 <11.5.30
- Fixed in
- 11.5.30
composer require typo3/cms-core:^11.5.30- Affected
- >=12.0.0 <12.4.4
- Fixed in
- 12.4.4
composer require typo3/cms-core:^12.4.4Details
> ### CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C (3.5)
Problem
In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.
Solution
Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 that fix the problem described above.
> ℹ️ Strong security defaults - Manual actions required
> Resolving sites by the id and L HTTP query parameters is now denied per default. However, it is still allowed to resolve a particular page by e.g. https://example.org/?id=123&L=0 - as long as the page-id 123 is in the scope of the site configured for the base-url example.org.
> The new feature flag security.frontend.allowInsecureSiteResolutionByQueryParameters - which is disabled per default - can be used to reactivate the previous behavior.
Credits
Thanks to Garvin Hicking who reported this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References
Is GHSA-jq6g-4v5m-wm9r in any of your client repos?
Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected typo3/cms-core, and gives you the command that fixes it.
References
Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.