CVE-2020-15515

Vulnerability

Description

The Turn! extension (turn) for TYPO3, in versions 0.3.2 and below, contains a remote code execution vulnerability. The root cause is a failure to properly sanitize user input, enabling an attacker to inject arbitrary commands [3]. This issue has been assigned CVE-2020-15515.

Exploitation

Prerequisites

Exploitation requires that the attacker already has FTP/SFTP access to the TYPO3 website [3]. This condition limits the attack surface to situations where an adversary has obtained legitimate or compromised credentials for file transfer, or where such access is otherwise available.

Impact

Successful exploitation allows the attacker to execute arbitrary code on the server. This can lead to full compromise of the confidentiality, integrity, and availability of the affected system, potentially including data theft, site defacement, or further lateral movement [2][3].

Mitigation

The vulnerability has been fixed in version 0.3.3 of the extension. Users are strongly advised to update as soon as possible via the TYPO3 extension manager, Packagist, or the official download link [3]. No workarounds have been provided.