GHSA-ppgf-8745-8pgx: 
PHP vulnerability analysis and mitigation

A high-severity vulnerability was discovered in TYPO3 CMS, identified as TYPO3-CORE-SA-2018-002, involving Insecure Deserialization & Arbitrary Code Execution. The vulnerability affects TYPO3 CMS versions 7.0.0 to 7.6.29, 8.0.0 to 8.7.16, and 9.0.0 to 9.3.0, with a disclosure date of July 12, 2018. The issue was reported by Sam Thomas from secarma.co.uk and was subsequently fixed by TYPO3 core team members (TYPO3 Advisory).

The vulnerability stems from the way TYPO3 CMS handles Phar files (PHP archives). These files can act as self-extracting archives that execute source code when invoked. The security issue arises because Phar files are not restricted to specific file extensions - they can be disguised as image or text files (e.g., 'bundle.txt' instead of 'bundle.phar'). The vulnerability is rated as High severity, with a suggested CVSS v2.0 score of AV:N/AC:M/Au:S/C:C/I:C/A:C/E:H/RL:OF/RC:C (TYPO3 Advisory).

The vulnerability allows for arbitrary code execution through insecure deserialization. When exploited, attackers could potentially execute malicious code on the affected TYPO3 installation. The impact is particularly significant in the backend system where manipulated URLs in TYPO3 backend forms could trigger the execution of disguised Phar files (GitHub Advisory).

Exploitation of this vulnerability requires a valid backend user account. While the attack vector could theoretically be possible in the TYPO3 frontend, no functional exploit has been identified for frontend attacks. The vulnerability can be exploited through manipulated URLs in TYPO3 backend forms, allowing the execution of disguised Phar files that have been uploaded to the system (TYPO3 Advisory).

The vulnerability was patched in TYPO3 versions 7.6.30, 8.7.17, and 9.3.2. The fix implements two main security measures: first, blocking the direct attack vector, and second, limiting Phar file invocation to only those located in TYPO3 extensions (path typo3conf/ext/) using a custom PHP stream wrapper. Additionally, administrators should ensure that third-party extensions do not store arbitrary user-submitted files in typo3conf/ext/ directories. The PHP PharStreamWrapper was later extracted from the TYPO3 core and released as an independent standalone Composer package (TYPO3 Advisory).