GHSA-cc97-g92w-jm65: 
PHP vulnerability analysis and mitigation

A critical vulnerability (GHSA-cc97-g92w-jm65) was discovered in TYPO3 CMS, identified as Insecure Deserialization & Arbitrary Code Execution. The vulnerability affects versions 8.0.0 to 8.7.16, 9.0.0 to 9.3.1, and 7.0.0 to 7.6.29. It was disclosed on July 12, 2018, and has been assigned a CVSS v3.1 score of 9.8 (Critical) (GitHub Advisory).

The vulnerability involves PHP's Phar file format, which can act as self-extracting archives leading to code execution when invoked. Phar files are not restricted to specific file extensions, allowing them to be disguised as image or text files (e.g., 'bundle.txt' instead of 'bundle.phar'). Due to insufficient user input sanitization, these Phar files could be triggered through manipulated URLs in TYPO3 backend forms (TYPO3 Advisory).

The vulnerability allows for arbitrary code execution through insecure deserialization. When successfully exploited, it provides an attacker with high levels of access to system confidentiality, integrity, and availability. The attack can be executed remotely with low complexity, though it requires valid backend user credentials (GitHub Advisory).

Exploitation requires a valid backend user account to manipulate URLs in TYPO3 backend forms. While theoretically possible in the TYPO3 frontend, no functional exploit has been identified for frontend attacks. The vulnerability can be exploited by uploading disguised Phar files that bypass standard file extension restrictions (TYPO3 Advisory).

The vulnerability was patched in versions 7.6.30, 8.7.17, and 9.3.2. The fix implements a custom PHP stream wrapper that limits Phar file execution to those located in TYPO3 extensions (path typo3conf/ext/). Additionally, direct attack vectors were blocked, and Phar files stored in other locations cannot be invoked. Organizations are advised to ensure third-party extensions do not store arbitrary user-submitted files in typo3conf/ext/ directories (TYPO3 Advisory).