GHSA-g4xv-r3qw-v3q2: 
PHP vulnerability analysis and mitigation

A security vulnerability was identified in TYPO3 Neos that allows unauthorized access to internal workspaces. The issue affects Neos versions from 2.3 through 4.3, with the disclosure date of June 17, 2019. The vulnerability enables unauthenticated users to view content in internal workspaces, which are non-public workspaces without specific owners (Neos Blog).

The vulnerability allows unauthorized access to internal workspaces through a specific URL format: https://domain/path/to/page.html@workspace-name. The issue has been assigned a high severity rating and affects multiple version ranges including 2.3.0-2.3.99, 3.0.0-3.0.20, 3.1.0-3.1.18, 3.2.0-3.2.14, 3.3.0-3.3.23, 4.0.0-4.0.17, 4.1.0-4.1.16, 4.2.0-4.2.12, and 4.3.0-4.3.3. The suggested CVSS score is CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C/CR:L/IR:L/AR:L (Neos Blog, GitHub Advisory).

The vulnerability allows read-only access to internal workspaces. While the issue is significant, its impact is somewhat limited as there are no default internal workspaces, and the vulnerability only affects user-created workspaces. Additionally, an attacker would need to know the specific workspace name, which includes a hash unique to each project (GitHub Advisory).

Exploitation requires knowledge of the workspace name including its hash, which is not trivially discoverable. However, it could potentially be obtained through brute force attempts or educated guesses. The vulnerability can be exploited by accessing a specific URL format that includes the workspace name (Neos Blog).

The vulnerability has been patched in versions 2.3.99, 3.0.20, 3.1.18, 3.2.14, 3.3.23, 4.0.17, 4.1.16, 4.2.12, and 4.3.3. Users are advised to update both neos/neos and neos/contentrepository packages to the newest bugfix versions. For Neos 2.3 users, immediate update is strongly recommended (GitHub Advisory, Neos Blog).