Executive brief
The Apache Solr for TYPO3 extension, used to provide search functionality on TYPO3 websites, fails to restrict advanced Solr query syntax in user-supplied search parameters. An unauthenticated attacker can exploit this to enumerate database field names and extract sensitive indexed data through blind search techniques, bypassing any site-specific access controls.
Technical details
The vulnerability is an information disclosure issue (CWE-943) in the TYPO3 Apache Solr for TYPO3 extension. The root cause is insufficient input validation: the extension passes user-supplied search query parameters directly to Apache Solr without sanitizing or restricting advanced Solr query syntax (wildcards, field selectors, range queries). An unauthenticated, remote attacker can leverage boolean-based and range-based blind extraction techniques to enumerate indexed field names and extract their stored values. This attack succeeds regardless of site-specific configuration or access controls. No authentication is required, and the attack is network-accessible.
Affected products
- TYPO3 Apache Solr for TYPO3 11.2.7 and below, 11.5.0-11.6.5, 12.0.0-12.1.3, 13.0.0-13.1.3
Timeline
- 2026-08-25: disclosed
- 2026-08-25: patched: Updated versions 11.2.8, 11.6.6, 12.1.4 and 13.1.4 available