TYPO3 ns_backup Extension Command Injection Vulnerability

A command injection vulnerability has been identified in the ns_backup extension for TYPO3, affecting versions through 13.0.0. The issue arises because the extension fails to properly sanitize user input when creating backups, allowing an authenticated backend user with access to the extension's backend module to execute arbitrary commands. Additionally, the extension saves backup and configuration files to a predictable location, enabling an unauthenticated remote user to download these files. The vulnerability also includes cross-site scripting issues due to improper input encoding in the TYPO3 backend user interface.

Impact

Exploitation of this vulnerability allows for command injection, where an authenticated user can execute arbitrary commands on the server. The predictable resource location vulnerability could lead to unauthorized access to sensitive backup and configuration files. The cross-site scripting vulnerability could be exploited to inject malicious scripts that are executed in the context of the user's browser.

Remediation

Users are advised to update the ns_backup extension to version 13.0.1, available through the TYPO3 extension manager, Packagist, or the TYPO3 Extensions Repository. It is also recommended to download and remove all previously created backup files to eliminate any files that may be affected by the predictable resource location vulnerability.