GHSA-rj3x-wvc6-5j66 TYPO3 vulnerable to Improper Access Control Persisting File Abstraction Layer Entities via Data Handler

• Packagist typo3/cms-core: >= 8.0.0, < 8.7.57 → fixed in 8.7.57 • Packagist typo3/cms-core: >= 9.0.0, < 9.5.46 → fixed in 9.5.46 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.43 → fixed in 10.4.43 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.35 → fixed in 11.5.35 • Packagist typo3/cms-core: >= 12.0.0, < 12.4.11 → fixed in 12.4.11 • Packagist typo3/cms-core: >= 13.0.0, < 13.0.1 → fixed in 13.0.1

Problem Entities of the File Abstraction Layer (FAL) could be persisted directly via `DataHandler`. This allowed attackers to reference files in the fallback storage directly and retrieve their file names and contents. The fallback storage ("zero-storage") is used as a backward compatibility layer for files located outside properly configured file storages and within the public web root directory. Exploiting this vulnerability requires a valid backend user account. Solution Update to TYPO3 versions 8.7.57 ELTS, 9.5.46 ELTS, 10.4.43 ELTS, 11.5.35 LTS, 12.4.11 LTS, 13.0.1 that fix the problem described. ℹ️ Strong security defaults - Manual actions required When persisting entities of the File Abstraction Layer directly via DataHandler, `sys_file` entities are now denied by default, and `sys_file_reference` & `sys_file_metadata` entities are not permitted to reference files in the fallback storage anymore. When importing data from secure origins, this must be explicitly enabled in the corresponding DataHandler instance by using `$dataHandler->isImporting = true;`. Credits Thanks to TYPO3 core & security team member Oliver Hader who reported and fixed the issue. References • TYPO3-CORE-SA-2024-006