Cross-Site Scripting in Content Preview

CVE-2021-21340 is a cross-site scripting (XSS) vulnerability in the TYPO3 content management system, affecting versions prior to 10.4.14 and 11.1.1. The issue arises because database fields designated as the *descriptionColumn* are not properly sanitized before being rendered in previews. When a backend user views a record in the TYPO3 backend interface, the content of these description fields is displayed without adequate escaping, allowing an attacker to inject malicious JavaScript [1][2].

To exploit this vulnerability, an attacker must have a valid backend user account with the ability to edit records and modify the content of a descriptionColumn field. The attack does not require any special privileges beyond standard backend access. When the crafted content is later previewed by another backend user (or the same user), the injected script executes in the context of the victim's browser session within the TYPO3 backend [2][3].

Successful exploitation can lead to a range of attacks, including session hijacking, privilege escalation, or unauthorized actions performed on behalf of the victim. Because the script runs in the backend interface, it can access cookies, CSRF tokens, and perform administrative operations. The vulnerability is classified as a stored XSS (also known as Type 2 or persistent XSS) since the payload persists in the database and triggers when the content is rendered [2][4].

The TYPO3 project has addressed this vulnerability in releases 10.4.14 and 11.1.1. Administrators are strongly advised to update their installations to these versions or later. No workarounds have been provided for unpatched versions, and as of the publication date, there is no evidence of exploitation in the wild according to CISA's known exploited vulnerabilities catalog [2][3].