Cross-Site Scripting in Content Preview (CType menu)

Vulnerability

CVE-2021-21370 is a cross-site scripting (XSS) vulnerability in TYPO3, an open-source PHP-based web content management system. The flaw exists in content elements of type menu. When these menu items are previewed in the page module, the referenced items are not properly sanitized, allowing malicious script content to be executed [1][2]. The root cause lies in insufficient output encoding of data used in the preview context.

Exploitation

Exploitation requires a valid backend user account with access to the page module [2]. An attacker with such privileges can craft a menu content element that references items containing malicious JavaScript. When the menu is previewed, the injected script executes in the browser of the backend user viewing the preview [3][4]. This is a stored XSS scenario, as the malicious content is persisted in the database.

Impact

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the backend session. This can lead to session hijacking, unauthorized actions on behalf of the victim, or theft of sensitive information displayed in the backend interface. The attack is limited to authenticated users, reducing the pool of potential victims but still posing a significant risk within trusted environments.

Mitigation

The vulnerability is patched in TYPO3 versions 7.6.51, 8.7.40, 9.5.25, 10.4.14, and 11.1.1 [2]. Administrators are advised to upgrade to these or later versions immediately. No workarounds have been published, and the vendor recommends applying the patch as the only reliable fix [1][2].