Executive Summary

This vulnerability is an insecure deserialization issue in the TYPO3 Mailqueue extension. The extension extends TYPO3's FileSpool component, which was previously vulnerable to unsafe deserialization. Even after the TYPO3 core was patched, the extension overwrites the fix by including the vulnerable code extracted from the core. This allows attackers to exploit unsafe deserialization of messages from files, potentially leading to object injection or execution of malicious code. The vulnerability arises because the extension uses PHP's native unserialize() function unsafely, which was replaced in the fix by a polymorphic deserializer that restricts allowed classes during deserialization and adds exception handling to prevent exploitation. [1, 2, 3]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow an attacker with local access and low privileges to exploit unsafe deserialization in the mailqueue system. This could lead to security risks such as object injection or execution of malicious code within the TYPO3 environment. Although the attack requires local access and partial attack type, it can compromise the integrity of the system and potentially escalate privileges or disrupt normal operations. The CVSS score indicates a medium severity with high scope and security impact, emphasizing the importance of applying the fix. [1, 2, 3]

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate this vulnerability, you should update the Mailqueue extension to versions 0.5.1 or 0.4.3 or later, which include the security fix. These updated versions are available via the TYPO3 extension manager, Packagist, and the TYPO3 extensions repository. The fix involves replacing unsafe unserialize() calls with a polymorphic deserializer that restricts allowed classes during deserialization and adds exception handling to prevent exploitation. Users are strongly advised to update promptly to these fixed versions to avoid insecure deserialization risks. [2]

Useful 0 Not Useful 0