Hacking TYPO3 - a journey through recent security vulnerabilities

on YouTube ↗48m

" summary

Demonstrations use a DDEV/Docker TYPO3 9.5.8 (security fixes removed) hacking playground from a public GitHub repo and a rips Tech scanner to show concrete exploits: a cross-site scripting session hijack via media asset entries that reads install tool cookies and can open the install tool, untrusted deserialization -> RCE by abusing overrideValues and a file cookie jar to drop executable PHP, and a leaked localconf.php encryption key that forges signed trustedProperties to escalate frontend access; most payloads succeed in the demo though a few fail due to permissions.

AI-written summary · about

" chapters (13)

1. 0:00Introduction and disclaimer
2. 1:45Importance of security awareness
3. 2:30CIA triad explained
4. 5:27OWASP Top 10 and TYPO3 impact
5. 7:39Hacking playground setup
6. 8:43Session hijacking via XSS
7. 18:09Remote code execution via deserialization
8. 21:42Exploiting file cookie jar
9. 30:17Backup file encryption key attack
10. 36:03Post-hack cleanup and backups
11. 37:29Flexibility leading to XSS
12. 40:42Remote code execution via page TSconfig
13. 43:01Final demos and Q&A

" related talks

• 01h 01mHow hacking works - Web editionEspen Sande-Larsen · NDC Oslo 2023
• 53mHow hacking works - Web editionEspen Sande-Larsen · NDC London 2024
• 51mHow hacking works - Web editionEspen Sande-Larsen · NDC Sydney 2024
• 52mDevSecOpsBrian Vermeer · Devnexus 2022
• 37mSecuring Containers by Breaking InBrian Vermeer · Conf42 Cloud Native 2021
• 57mWhat vulnerabilities? Live hacking of containers and orchestratorsLewis Denham Parry · NDC Oslo 2019
• 02h 27mHow hacking works (Workshop edition)Espen Sande-Larsen · Build Stuff 2024
• 41mLive Hacking: Breaking into Your Web AppBrian Vermeer · GOTO Amsterdam 2022