CRITICAL9.8

GHSA-598p-rv6p-g7qc

sr_freecap for Typo3 RCE Vulnerability

Quick fix

GHSA-598p-rv6p-g7qc — sjbr/sr-freecap: upgrade to the fixed version with the command below.

composer require sjbr/sr-freecap:^2.5.3

Details

The sr_freecap (aka freeCap CAPTCHA) extension 2.4.5 and below and 2.5.2 and below for TYPO3 fails to sanitize user input, which allows execution of arbitrary Extbase actions, resulting in Remote Code Execution.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/sjbr/sr-freecap

Introduced in: 2.5.0Fixed in: 2.5.3

Fixcomposer require sjbr/sr-freecap:^2.5.3

Packagist/sjbr/sr-freecap

Introduced in: 0Fixed in: 2.4.6

Fixcomposer require sjbr/sr-freecap:^2.4.6

References

https://nvd.nist.gov/vuln/detail/CVE-2019-16699[ADVISORY]
https://extensions.typo3.org/extension/sr_freecap[WEB]
https://github.com/mavolkmer/sr-freecap[PACKAGE]
https://typo3.org/security/advisory/typo3-ext-sa-2019-018[WEB]