CVE-2009-4159

Vulnerability

The Direct Mail (direct_mail) extension for TYPO3 contains a persistent cross-site scripting (XSS) vulnerability in its backend newsletter configuration feature. The flaw exists in versions 2.6.4 and earlier; the extension does not properly sanitize user-supplied input, allowing the injection of arbitrary web script or HTML [1][3]. The vulnerable component is the backend module used by editors to administrate newsletter configurations [3].

Exploitation

An attacker must be an authenticated website editor with access to the Direct Mail backend module. By crafting specially crafted JavaScript or HTML in the newsletter configuration fields, the attacker can inject malicious code [3]. The injected script executes in the context of the backend module, potentially affecting other editors or administrators who view the configuration [1][3].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript or HTML in the backend of the TYPO3 installation. This can lead to session hijacking, defacement, or theft of sensitive data. Additionally, with specially crafted JavaScript, attackers may create malicious database records [3]. The impact is limited to authenticated users in the backend; however, it can escalate to broader compromise if administrative actions are performed by the victim.

Mitigation

The vulnerability is fixed in version 2.6.5, which is available from the TYPO3 extension manager and the TYPO3 extension repository [3][4]. Users of the Direct Mail extension are advised to update to 2.6.5 as soon as possible. No workaround is documented for unpatched installations. The extension is not part of the TYPO3 default installation [3].