Cross-Site Scripting via Rich-Text Content

Vulnerability

TYPO3 CMS versions 7.0.0 through 7.6.52 ELTS, 8.0.0 through 8.7.41 ELTS, 9.0.0 through 9.5.28, 10.0.0 through 10.4.18, and 11.0.0 through 11.3.1 are affected by a cross-site scripting (XSS) vulnerability in the rich-text content rendering process. The HTMLparser TypoScript function fails to properly parse, sanitize, and encode malicious HTML tags and attributes, allowing injection of arbitrary markup [1][2].

Exploitation

In a default configuration, a valid backend user account is required to exploit this vulnerability. However, if custom plugins in the website frontend accept and reflect rich-text content submitted by users, no authentication is needed. An attacker can craft malicious rich-text content that, when rendered by the frontend, executes arbitrary JavaScript in the context of the victim's browser [2].

Impact

Successful exploitation leads to cross-site scripting (XSS), enabling the attacker to execute arbitrary JavaScript in the victim's browser. This can result in information disclosure, session hijacking, or other malicious actions performed on behalf of the victim [1][2].

Mitigation

Update to TYPO3 versions 7.6.53 ELTS, 8.7.42 ELTS, 9.5.29, 10.4.19, or 11.3.2, which include the typo3/html-sanitizer package that sanitizes malicious markup based on allow-lists. This sanitization is applied to the default TypoScript path lib.parseFunc and to rich-text data from the backend user interface. No workaround is available without applying the fix [2].