Executive brief
The Direct Mail extension for TYPO3 (a popular content management system) contains a configuration injection vulnerability in its backend administration module. Authenticated administrators with access to Direct Mail settings can inject arbitrary code that leads to configuration manipulation or, in older TYPO3 versions, full system compromise through arbitrary code execution. This requires a valid backend user account but poses a significant risk to website operations and data security.
Technical details
The vulnerability is a configuration injection flaw (CWE-15, CWE-95) in the Direct Mail extension's Configuration backend module that permits authenticated users to write arbitrary page TSConfig values for directories marked as Direct Mail folders. The attack vector is network-based but requires authentication (PR:L) and no user interaction. On TYPO3 9.5 and below, this directly enables arbitrary code execution; on TYPO3 10.4 and above, it results in configuration injection attacks. Patched versions (6.0.3, 7.0.3, 9.5.2) are available; all users should update immediately and audit existing Direct Mail folder configurations for suspicious TSConfig entries.
Affected products
- TYPO3 Direct Mail 6.0.2 and below, 7.0.0-7.0.2, 8.0.0-9.5.1
- TYPO3 TYPO3 9.5, 10.4 and above
Timeline
- 2023-12-13: disclosed: TYPO3 security advisory TYPO3-EXT-SA-2023-011 published
- 2023-12-13: patched: Fixed versions 6.0.3, 7.0.3, 9.5.2 released
- 2023: other: CVE-2023-50461 assigned