Indexed Search Engine for TYPO3 Command Execution via Metacharacter Injection
High severity
GitHub Reviewed
Published
May 2, 2022
to the GitHub Advisory Database
•
Updated Jan 23, 2024
Package
Affected versions
>= 4.0.0, <= 4.0.9
>= 4.1.0, <= 4.1.7
>= 4.2.0, <= 4.2.3
Patched versions
4.0.10
4.1.8
4.2.4
Description
Published by the National Vulnerability Database
Jan 22, 2009
Published to the GitHub Advisory Database
May 2, 2022
Reviewed
Jan 23, 2024
Last updated
Jan 23, 2024
The Indexed Search Engine (indexed_search) system extension in TYPO3 4.0.0 through 4.0.9, 4.1.0 through 4.1.7, and 4.2.0 through 4.2.3 allows remote attackers to execute arbitrary commands via a crafted filename containing shell metacharacters, which is not properly handled by the command-line indexer.
References