what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Typo3 CMS 6.2.14 / 4.5.40 Cross Site Scripting

Typo3 CMS 6.2.14 / 4.5.40 Cross Site Scripting
Posted Sep 14, 2015
Authored by Julien Ahrens

Typo3 CMS versions 6.2.14 and below and 4.5.40 and below suffer from a cross site scripting vulnerability.

tags | exploit, xss
advisories | CVE-2015-5956
SHA-256 | 5fe660afc121bc98f78855bc4c8a79507bdd0980f0cc631158e37e50937cd828

Typo3 CMS 6.2.14 / 4.5.40 Cross Site Scripting

Change Mirror Download
secunet Security Networks AG Security Advisory

Advisory: Typo3 Core sanitizeLocalUrl() Non-Persistent Cross-Site Scripting

Product: Typo3 CMS
Vendor URL: typo3.org
Type: Cross-site Scripting[CWE-79]
Date found: 2015-07-30
Date published: 2015-09-14
CVSSv2 Score: 3,5 (AV:N/AC:M/Au:S/C:N/I:P/A:N)
CVE: CVE-2015-5956

Typo3 6.2.14 and below
Typo3 4.5.40 and below
and other older versions may be affected too.

"With more than 500,000 installations TYPO3 CMS is the most widely used
Enterprise Content Management System, providing the basis for websites,
intranets and web & mobile applications worldwide."

(from the vendor's homepage)

The Typo3 version branches 6.x and 4.x are vulnerable to an authenticated,
non-persistent Cross-Site Scripting vulnerability when user-supplied input
is processed by the sanitizeLocalUrl() function. While there is already a
XSS filter in place, it is possible to mitigate it by using a data URI with
a base64 encoded payload.

The payload is slightly different through the vulnerable branches, 6.x needs
a space in the data URI payload, while 4.x doesn't. In the following proof
of concepts, the javascript <script>alert('XSS')</script> is used as a
base64 encoded data URI in the "returnUrl" and "redirect_url" parameters,
which can be found throughout Typo3.

4.x Branch Proof-of-Concept:
The following request forges the "back" link in the Typo3 "Show record
history" backend module:

6.x Branch Proof-of-Concept:
Typo3 uses the payload from the "redirect_url" parameter in the HTTP
Location header and therefore "redirects" the victim to the payload after
logging in:

7.x Branch:
The 7.x branch is basically vulnerable too, but the attacker additionally
needs to know a secret token (moduleToken), which is included in every
request in order to successfully exploit the vulnerability, which makes
exploitation unfeasible.

The following request forges the "back" link in the Typo3 "Show record
history" backend module:

The vulnerability can be used to temporarily embed arbitrary script code
into the context of the Typo3 backend interface, which offers a wide range
of possible attacks such as stealing cookies or attacking the browser and
its components.

The exploit probability is different depending on the attacked parameters.
In order to exploit the "redirect_url" parameter, the victim only has to
login to the backend interface, while there is an even higher amount of user
interaction needed to exploit the "returnUrl" parameter, because the victim
needs to be logged in to the backend with appropriate access rights, follow
the prepared link and has to click on the "Back" button in the view.

Update to TYPO3 versions 6.2.15 or 7.4.0

2015-07-30: Vulnerability discovered
2015-08-03: CVE requested from MITRE
2015-08-04: Vendor notified
2015-08-07: CVE-2015-5956 assigned
2015-08-07: Vendor acknowledges the vulnerability
2015-09-08: Vendor releases update and security advisory
2015-09-14: Advisory released

This vulnerability was discovered and researched by Julien Ahrens from
secunet Security Networks AG.


secunet Security Networks AG
secunet is one of Germany's leading providers of superior IT security. In
close dialogue with its customers – enterprises, public authorities and
international organisations – secunet develops and implements
high-performance products and state-of-the-art IT security solutions. Thus,
secunet not only keeps IT infrastructures secure for its customers, but also
achieves intelligent process optimisation and creates sustainable added
value. More information about secunet can be found at:

secunet Security Networks AG
Kronprinzenstra├če 30
45128 Essen, Germany
Local Court of Essen HRB 13615
Board of management: Dr. Rainer Baumgart (CEO), Thomas Pleines
Login or Register to add favorites

File Archive:

October 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    10 Files
  • 2
    Oct 2nd
    0 Files
  • 3
    Oct 3rd
    0 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By