CVE-2010-3714
TYPO3 4.2.0-4.2.14, 4.3.0-4.3.6, 4.4.0-4.4.3 - Unauthenticated Arbitrary File Read via jumpUrl Hash Comparison
Title source: llmExploitation Summary
EIP tracks 2 public exploits for CVE-2010-3714.
PoCs published by ikki, Chris John Riley, Gregor Kopf, including Metasploit module auxiliary/admin/http/typo3_sa_2010_020.
AI-analyzed exploit summary This exploit leverages a non-typesafe comparison flaw (CVE-2010-3714) and a fileDenyPattern bypass in TYPO3 to retrieve arbitrary files without authentication. It first discloses the encryption key and then allows file retrieval via crafted requests.
Description
The jumpUrl (aka access tracking) implementation in tslib/class.tslib_fe.php in TYPO3 4.2.x before 4.2.15, 4.3.x before 4.3.7, and 4.4.x before 4.4.4 does not properly compare certain hash values during access-control decisions, which allows remote attackers to read arbitrary files via unspecified vectors.
Exploits (2)
This exploit leverages a non-typesafe comparison flaw (CVE-2010-3714) and a fileDenyPattern bypass in TYPO3 to retrieve arbitrary files without authentication. It first discloses the encryption key and then allows file retrieval via crafted requests.
This Metasploit module exploits a flaw in TYPO3's jumpurl feature to perform remote file disclosure by brute-forcing a hash collision (juHash=0). It allows reading arbitrary files accessible to the web server user.