Improperly Controlled Modification of Dynamically-Determined Object Attributes in TYPO3 CMS

Vulnerability

Overview

CVE-2020-11066 is an insecure deserialization vulnerability in TYPO3 CMS that occurs when calling unserialize() on malicious user-submitted content. The vulnerability resides in the core component (ext:core) and affects TYPO3 versions 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1 [1][4]. The root cause involves class destructors that, when triggered during deserialization, can modify dynamically-determined object attributes, leading to unintended side effects [4].

Exploitation

Conditions

Exploitation requires an additional insecure deserialization vulnerability to be present to actually trigger the described impacts [1][4]. The attack vector involves network access with high complexity, and no authentication is required according to the CVSS vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H) [4]. An attacker must be able to submit serialized data to a vulnerable TYPO3 instance, typically through user input fields or parameters that are deserialized without proper validation.

Impact

Successful exploitation can result in deletion of an arbitrary directory in the file system, provided it is writable by the web server [1][4]. Additionally, the vulnerability can be leveraged to trigger message submission via email using the identity of the web site, effectively turning the server into a mail relay [1][4]. The integrity and availability impacts are rated high, while confidentiality remains unaffected [4].

Mitigation

The vulnerability has been fixed in TYPO3 versions 9.5.17 and 10.4.2 [1][4]. Administrators are strongly advised to update their installations to these patched versions or later. No workarounds are mentioned in the official advisory. The issue was reported and fixed by TYPO3 security team member Oliver Hader [4].