Information Disclosure due to Out-of-scope Site Resolution
The advisory, in context
CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N/E:F/RL:O/RC:C(3.5)
Problem
In multi-site scenarios, enumerating the HTTP query parameters id and L allowed out-of-scope access to rendered content in the website frontend. For instance, this allowed visitors to access content of an internal site by adding handcrafted query parameters to the URL of a site that was publicly available.
Solution
Update to TYPO3 versions 9.5.42 ELTS, 10.4.39 ELTS, 11.5.30, 12.4.4 that fix the problem described above.
ℹ️ Strong security defaults - Manual actions required Resolving sites by the
idandLHTTP query parameters is now denied per default. However, it is still allowed to resolve a particular page by e.g.https://example.org/?id=123&L=0- as long as thepage-id 123is in the scope of the site configured for thebase-url example.org. The new feature flagsecurity.frontend.allowInsecureSiteResolutionByQueryParameters- which is disabled per default - can be used to reactivate the previous behavior.
Credits
Thanks to Garvin Hicking who reported this issue, and to TYPO3 core & security team members Oliver Hader and Benjamin Franzke who fixed the issue.
References
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 9.4.0 before 9.5.42
Fixed in 9.5.42
33 explicitly affected versions
v9.4.0, v9.5.0, v9.5.1, v9.5.10, v9.5.11, v9.5.12, v9.5.13, v9.5.14, v9.5.15, v9.5.16, v9.5.17, v9.5.18, v9.5.19, v9.5.2, v9.5.20, v9.5.21, v9.5.22, v9.5.23, v9.5.24, v9.5.25, v9.5.26, v9.5.27, v9.5.28, v9.5.29, v9.5.3, v9.5.30, v9.5.31, v9.5.4, v9.5.5, v9.5.6, v9.5.7, v9.5.8, v9.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "9.4.0"
},
{
"fixed": "9.5.42"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v9.4.0",
"v9.5.0",
"v9.5.1",
"v9.5.10",
"v9.5.11",
"v9.5.12",
"v9.5.13",
"v9.5.14",
"v9.5.15",
"v9.5.16",
"v9.5.17",
"v9.5.18",
"v9.5.19",
"v9.5.2",
"v9.5.20",
"v9.5.21",
"v9.5.22",
"v9.5.23",
"v9.5.24",
"v9.5.25",
"v9.5.26",
"v9.5.27",
"v9.5.28",
"v9.5.29",
"v9.5.3",
"v9.5.30",
"v9.5.31",
"v9.5.4",
"v9.5.5",
"v9.5.6",
"v9.5.7",
"v9.5.8",
"v9.5.9"
]
}From 10.0.0 before 10.4.39
Fixed in 10.4.39
43 explicitly affected versions
v10.0.0, v10.1.0, v10.2.0, v10.2.1, v10.2.2, v10.3.0, v10.4.0, v10.4.1, v10.4.10, v10.4.11, v10.4.12, v10.4.13, v10.4.14, v10.4.15, v10.4.16, v10.4.17, v10.4.18, v10.4.19, v10.4.2, v10.4.20, v10.4.21, v10.4.22, v10.4.23, v10.4.24, v10.4.25, v10.4.26, v10.4.27, v10.4.28, v10.4.29, v10.4.3, v10.4.30, v10.4.31, v10.4.32, v10.4.33, v10.4.34, v10.4.36, v10.4.37, v10.4.4, v10.4.5, v10.4.6, v10.4.7, v10.4.8, v10.4.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "10.0.0"
},
{
"fixed": "10.4.39"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v10.0.0",
"v10.1.0",
"v10.2.0",
"v10.2.1",
"v10.2.2",
"v10.3.0",
"v10.4.0",
"v10.4.1",
"v10.4.10",
"v10.4.11",
"v10.4.12",
"v10.4.13",
"v10.4.14",
"v10.4.15",
"v10.4.16",
"v10.4.17",
"v10.4.18",
"v10.4.19",
"v10.4.2",
"v10.4.20",
"v10.4.21",
"v10.4.22",
"v10.4.23",
"v10.4.24",
"v10.4.25",
"v10.4.26",
"v10.4.27",
"v10.4.28",
"v10.4.29",
"v10.4.3",
"v10.4.30",
"v10.4.31",
"v10.4.32",
"v10.4.33",
"v10.4.34",
"v10.4.36",
"v10.4.37",
"v10.4.4",
"v10.4.5",
"v10.4.6",
"v10.4.7",
"v10.4.8",
"v10.4.9"
]
}From 11.0.0 before 11.5.30
Fixed in 11.5.30
39 explicitly affected versions
v11.0.0, v11.1.0, v11.1.1, v11.2.0, v11.3.0, v11.3.1, v11.3.2, v11.3.3, v11.4.0, v11.5.0, v11.5.1, v11.5.10, v11.5.11, v11.5.12, v11.5.13, v11.5.14, v11.5.15, v11.5.16, v11.5.17, v11.5.18, v11.5.19, v11.5.2, v11.5.20, v11.5.21, v11.5.22, v11.5.23, v11.5.24, v11.5.25, v11.5.26, v11.5.27, v11.5.28, v11.5.29, v11.5.3, v11.5.4, v11.5.5, v11.5.6, v11.5.7, v11.5.8, v11.5.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "11.0.0"
},
{
"fixed": "11.5.30"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v11.0.0",
"v11.1.0",
"v11.1.1",
"v11.2.0",
"v11.3.0",
"v11.3.1",
"v11.3.2",
"v11.3.3",
"v11.4.0",
"v11.5.0",
"v11.5.1",
"v11.5.10",
"v11.5.11",
"v11.5.12",
"v11.5.13",
"v11.5.14",
"v11.5.15",
"v11.5.16",
"v11.5.17",
"v11.5.18",
"v11.5.19",
"v11.5.2",
"v11.5.20",
"v11.5.21",
"v11.5.22",
"v11.5.23",
"v11.5.24",
"v11.5.25",
"v11.5.26",
"v11.5.27",
"v11.5.28",
"v11.5.29",
"v11.5.3",
"v11.5.4",
"v11.5.5",
"v11.5.6",
"v11.5.7",
"v11.5.8",
"v11.5.9"
]
}From 12.0.0 before 12.4.4
Fixed in 12.4.4
11 explicitly affected versions
v12.0.0, v12.1.0, v12.1.1, v12.1.2, v12.1.3, v12.2.0, v12.3.0, v12.4.0, v12.4.1, v12.4.2, v12.4.3
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.4.4"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"v12.0.0",
"v12.1.0",
"v12.1.1",
"v12.1.2",
"v12.1.3",
"v12.2.0",
"v12.3.0",
"v12.4.0",
"v12.4.1",
"v12.4.2",
"v12.4.3"
]
}