CVE-2020-15099: 
PHP vulnerability analysis and mitigation

CVE-2020-15099 affects TYPO3 CMS versions greater than or equal to 9.0.0 and less than 9.5.20, and versions greater than or equal to 10.0.0 and less than 10.4.6. The vulnerability was discovered and disclosed on July 28, 2020, with a CVSS v3.1 base score of 7.5 (High severity) (TYPO3 Advisory, GitHub Advisory).

The vulnerability exists in the eID API component of TYPO3 CMS (ext:frontend, ext:core). It allows an attacker who can generate a valid cryptographic message authentication code (HMAC-SHA1) to retrieve arbitrary files from a TYPO3 installation. The vulnerability is classified under CWE-20 (Improper Input Validation) and CWE-200 (Exposure of Sensitive Information) (TYPO3 Advisory).

If exploited, the vulnerability allows attackers to access sensitive files including typo3conf/LocalConfiguration.php, which contains the encryptionKey and database credentials. If the database server is accessible via internet or shared hosting network, attackers can retrieve, manipulate, or delete database contents, and create administrator accounts. This ultimately enables remote code execution through custom extension injection (GitHub Advisory).

The vulnerability requires the attacker to either exploit another vulnerability or have access to the internal encryptionKey to generate a valid HMAC-SHA1. The attack complexity is rated as High in the CVSS scoring, indicating significant technical barriers to exploitation (TYPO3 Advisory).

The vulnerability has been patched in TYPO3 versions 9.5.20 and 10.4.6. Users are advised to update to these or later versions to address the security issue. TYPO3 also recommends following the recommendations provided in the TYPO3 Security Guide and subscribing to the typo3-announce mailing list for security updates (TYPO3 Advisory).