Hacking (insecure) TYPO3 v9 site during TYPO3camp Mitteldeutschland 2019 (T3CMD). Demonstrating impact of Cross-Site Scripting, compromised HMAC signing using (disclosed) encryption key via Insecure Deserialization as well as SQL Injection via insecure TypoScript.

1. Hacking
TYPO3
Oliver Hader
oliver@typo3.org
@ohader
TYPO3camp Mitteldeutschland
January 2019

2. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
~# whoami
2
▪~# whoami
▪Oliver Hader, M.Sc.
▪50% freelance web software engineer
▪50% employed at TYPO3 GmbH, Düsseldorf
▪TYPO3 security team lead (since 2019)
▪#hof, #cycling, #paramedic, #in.die.musik

3. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Basic Basics
3

4. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Web Application Security
4
▪ CIA/compliance triad
▪ confidentiality
▪ private, personal, sensitive information
▪ integrity
▪ manipulation of information (“fake news”)
▪ availability
▪ denial of service
▪ online bank account
▪ blocking information flow
https://www.ibm.com/blogs/cloud-computing/2018/01/16/drive-compliance-cloud/

5. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 5
Web Application Security
Open Web Application Security Project - TOP 10 vulnerabilities
https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf
TYPO3 core TYPO3 3rd party extensionsPHP world
TYPO3vulnerabilitiesinpast5years

6. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 6
Web Application Security
OWASP - Application Security Risks
https://www.owasp.org/images/7/72/OWASP_Top_10-2017_%28en%29.pdf.pdf

7. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
7

8. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
8
▪ $contentId = $_GET['id'] ?? 1;
▪ $statement = $connection->query($q="
▪ SELECT header,bodytext FROM tt_content
▪ WHERE uid='$contentId'
▪ ");
▪ $content = $statement->fetch();

9. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
9
▪ sqli.php?id=1%27%20UNION%20SELECT%20
username%20password%20FROM%20be_users
%20LIMIT%201,1%20--%20
▪ SELECT header, bodytext FROM tt_content
WHERE uid='1' UNION SELECT username,
password FROM be_users LIMIT 1,1 –– '
▪ Reflected SQL Injection (retrieving values)

10. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
10
▪ $contentId = $_GET['id'] ?? 1;
▪ // alright, what shall we do here?
▪ $contentId = htmlspecialchars($contentId);
▪ $statement = $connection->query($q="
▪ SELECT header,bodytext FROM tt_content
▪ WHERE uid='$contentId'
▪ ");
▪ $content = $statement->fetch();

11. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
11
▪ $contentId = $_GET['id'] ?? 1;
▪ // alright, what shall we do here?
▪ $contentId = escapeshellarg($contentId);
▪ $statement = $connection->query($q="
▪ SELECT header,bodytext FROM tt_content
▪ WHERE uid='$contentId'
▪ ");
▪ $content = $statement->fetch();

12. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
12
▪ $contentId = $_GET['id'] ?? 1;
▪ // alright, what shall we do here?
▪ $contentId = $connection->quote(contentId);
▪ $statement = $connection->query($q="
▪ SELECT header,bodytext FROM tt_content
▪ WHERE uid='$contentId'
▪ ");
▪ $content = $statement->fetch();

13. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Exam
13
▪ $contentId = $_GET['id'] ?? 1;
▪ // alright, what shall we do here?
▪ $contentId = (int)contentId;
▪ $statement = $connection->query($q="
▪ SELECT header,bodytext FROM tt_content
▪ WHERE uid='$contentId'
▪ ");
▪ $content = $statement->fetch();

14. Hacking
Playground
https://github.com/
ohader/typo3v9-
hack/
14T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3

15. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Hi-Jacking &
Remote Control
thanks to Cross-Site Scripting
15

16. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 16
Insecure Install Tool Cookie (HTTP-only flag missing)

17. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 17
Browser Exploitation Framework (admin/joh316)

18. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
Upgrade User
Privileges
thanks to
Security Misconfiguration
& Insecure Deserialization
18

19. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 19
Retrieve current XSRF token

20. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 20
… the XSRF token to be used for next attack …

21. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 21
“Render” LocalConfiguration.php instead of Thumbnail

22. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 22
… what else can we find here?

23. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 23
Extbase __trustedProperties deserialisation

24. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 24
HMAC signing of __trustedProperties - based on encryptionKey

25. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 25
Common attack via GuzzleHttpPsr7FnStream callback

26. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 26
… having new “h4ck3r31” admin account …

27. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3
“Anything”
thanks to insecure TypoScript
(Cross-Site Scripting & SQL Injection)
27

28. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 28
GET/POST data in TypoScript - insertData injection

29. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 29
… retrieving arbitrary values from database …

30. T3CMD19 TYPO3camp Mitteldeutschland 2019 - Hacking TYPO3 30
▪ TYPO3 Security Team needs YOU
▪ core, extension & infrastructure security
▪ GitHub, packagist.org - not only TER
▪ feedback, advise, educate
▪ analyse & hack (PoC)
▪ ask @ohader / oliver@typo3.org
TYPO3 Security Team