Known advisories · Question 12 of 12
TYPO3-CORE-SA-2023-001 (CVE-2023-24814) describes persistent XSS in the frontend. Under which TypoScript setting was the hole exploitable?
1 answer is correct. Hard
Show answer
Answer
- A config.absRefPrefix = auto
Explanation
The hole arose because GeneralUtility::getIndpEnv() used the unfiltered server variable PATH_INFO. With absRefPrefix = auto, HTML could be injected into pages not yet cached, which was then delivered to all visitors.