TYPO3 Powermail Extension Insecure Direct Object Reference Vulnerability

A vulnerability in the Powermail extension for TYPO3 allows for Insecure Direct Object Reference (IDOR), enabling authenticated users with access to the backend module to download arbitrary files from the web server. This issue affects Powermail versions 12.0.0 prior to 12.5.2 and 13.0.0. The vulnerability arises because the extension does not properly validate the 'file' query parameter in the 'downloadFile' function of the backend module. Exploitation requires at least one Powermail email record containing an uploaded file to be available in the backend.

Impact

Exploitation of this vulnerability could lead to unauthorized access and download of sensitive files from the web server.

Remediation

Users are advised to update to Powermail versions 12.5.3 or 13.0.1, available through the TYPO3 Extension Manager, Packagist, or directly from the TYPO3 Extension Repository.