TYPO3 Remote Code Execution in extension "Site Crawler" (crawler)
The advisory, in context
The TYPO3 Crawler extension passes the X-T3Crawler-Meta response header from crawled URLs directly to PHP's unserialize(). An attacker controlling a crawled endpoint can inject arbitrary serialized PHP objects, leading to Remote Code Execution on the TYPO3 server. Exploitation requires administrative privileges to configure a crawler-enabled page and trigger the crawl via a Scheduler task. This has been patched in versions 12.0.11 and 11.0.13.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 12.0.0 before 12.0.11
Fixed in 12.0.11
11 explicitly affected versions
12.0.0, 12.0.1, 12.0.10, 12.0.2, 12.0.3, 12.0.4, 12.0.5, 12.0.6, 12.0.7, 12.0.8, 12.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "12.0.0"
},
{
"fixed": "12.0.11"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"12.0.0",
"12.0.1",
"12.0.10",
"12.0.2",
"12.0.3",
"12.0.4",
"12.0.5",
"12.0.6",
"12.0.7",
"12.0.8",
"12.0.9"
]
}Earlier releases before 11.0.13
Fixed in 11.0.13
73 explicitly affected versions
10.0.0, 10.0.1, 10.0.2, 10.0.3, 11.0.0, 11.0.1, 11.0.10, 11.0.11, 11.0.12, 11.0.2, 11.0.3, 11.0.4, 11.0.5, 11.0.6, 11.0.7, 11.0.8, 11.0.9, 5.0.0, 5.0.1, 5.0.2, 5.0.3, 5.0.4, 5.0.5, 5.0.6, 5.0.7, 5.0.8, 5.0.9, 5.1.0, 5.1.1, 5.1.2, 5.1.3, 5.1.4, 5.2.0, 5.2.1, 6.0.0, 6.1.0, 6.1.1, 6.1.2, 6.2.0, 6.3.0, 6.3.1, 6.3.2, 6.4.0, 6.4.1, 6.5.0, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.7.0, 6.7.1, 6.7.2, 6.7.3, 6.7.4, 9.0.0, 9.0.1, 9.0.2, 9.0.3, 9.1.0, 9.1.1, 9.1.2, 9.1.3, 9.1.4, 9.1.5, 9.2.0, 9.2.1, 9.2.2, 9.2.3, 9.2.4, 9.2.5, 9.2.6
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "11.0.13"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.0.0",
"10.0.1",
"10.0.2",
"10.0.3",
"11.0.0",
"11.0.1",
"11.0.10",
"11.0.11",
"11.0.12",
"11.0.2",
"11.0.3",
"11.0.4",
"11.0.5",
"11.0.6",
"11.0.7",
"11.0.8",
"11.0.9",
"5.0.0",
"5.0.1",
"5.0.2",
"5.0.3",
"5.0.4",
"5.0.5",
"5.0.6",
"5.0.7",
"5.0.8",
"5.0.9",
"5.1.0",
"5.1.1",
"5.1.2",
"5.1.3",
"5.1.4",
"5.2.0",
"5.2.1",
"6.0.0",
"6.1.0",
"6.1.1",
"6.1.2",
"6.2.0",
"6.3.0",
"6.3.1",
"6.3.2",
"6.4.0",
"6.4.1",
"6.5.0",
"6.6.0",
"6.6.1",
"6.6.2",
"6.6.3",
"6.6.4",
"6.6.5",
"6.7.0",
"6.7.1",
"6.7.2",
"6.7.3",
"6.7.4",
"9.0.0",
"9.0.1",
"9.0.2",
"9.0.3",
"9.1.0",
"9.1.1",
"9.1.2",
"9.1.3",
"9.1.4",
"9.1.5",
"9.2.0",
"9.2.1",
"9.2.2",
"9.2.3",
"9.2.4",
"9.2.5",
"9.2.6"
]
}