TYPO3 vulnerable to an HTML Injection in the History Module

Vulnerability

Overview

The history backend module in TYPO3 CMS versions 13.0.0 through 13.1.0 is vulnerable to HTML injection. The root cause lies in the BackendUtility::getRecordTitle function, which returns a string that is not HTML-encoded when the $prep parameter is set to false. This unencoded output is then rendered in the history module, allowing an attacker to inject arbitrary HTML markup [1][4]. Although Content-Security-Policy (CSP) headers prevent JavaScript execution, the injection of HTML itself remains possible [3].

Exploitation

Prerequisites

Exploiting this vulnerability requires a valid backend user account with access to the history module. The attack vector is network-based (AV:N) and requires low complexity (AC:L) but relies on user interaction (UI:R) as the victim must view the crafted history entry [3]. The attacker can inject malicious HTML that, while unable to execute scripts due to CSP, can still alter the page appearance or include deceptive content such as fake login forms or phishing links.

Impact

An authenticated attacker can inject HTML markup into the backend interface, potentially leading to UI redressing, credential theft via fake forms, or other client-side attacks within the trusted backend context. The CVSS v3.1 score is low (3.5) with a partial integrity impact (I:L) and no confidentiality or availability impact [3]. The vulnerability does not allow direct data exfiltration or privilege escalation, but it undermines the integrity of the backend user interface.

Mitigation

The issue is fixed in TYPO3 version 13.1.1, which encodes the output of BackendUtility::getRecordTitle properly [3][4]. Users running affected versions should update immediately. No workaround is documented; upgrading is the recommended solution.