Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in typo3/cms-form

Root

Cause The Form Designer backend module in TYPO3's Form Framework is vulnerable to cross-site scripting (XSS). The vulnerability arises from insufficient sanitization of user-supplied input when rendering form elements within the module [2].

Exploitation

To exploit the vulnerability, an attacker must have a valid backend user account with access to the form module. The attacker can craft malicious input that, when processed by the Form Designer, executes arbitrary JavaScript in the context of the TYPO3 backend [2].

Impact

Successful exploitation allows an attacker to execute malicious scripts in the browser of other backend users, potentially leading to session hijacking, data theft, or further compromise of the TYPO3 instance. Access to the form module is a prerequisite, limiting the attack surface to authenticated users [2].

Mitigation

The vulnerability has been patched in TYPO3 versions 10.4.14 and 11.1.1. Users should upgrade to these versions immediately. No workaround is available for older versions [2].