MediumPublic exploit

TYPO3 jumpUrl juHash Information Disclosure Arbitrary File Read

IdentifiersCVE-2009-0815CWE-209

CVE-2009-0815 affects the jumpUrl mechanism in class.tslib_fe.php in TYPO3 3.3.x through 3.8.x, 4.0 before 4.0.12, 4.1 before 4.1.10, 4.2 before 4.2.6, and 4.3alpha1. The vulnerability arises because TYPO3 discloses the jumpUrl hash secret (juHash) in an error message. Once this secret is exposed, a remote attacker can supply the leaked hash in a crafted request to the jumpUrl functionality and bypass the intended protection, enabling arbitrary file reads from the server.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote attacker to read arbitrary files accessible to the TYPO3 process. This can expose sensitive application files, configuration data, credentials, and other local files, potentially facilitating further compromise of the TYPO3 instance or underlying environment.

Mitigation

If you can’t patch tonight, do this now.

Restrict public access to TYPO3 instances exposing the vulnerable jumpUrl functionality until patching is completed. Suppress or sanitize verbose error messages so secrets such as juHash are not disclosed to remote users. Limit the TYPO3 process's filesystem access using least-privilege permissions to reduce the impact of arbitrary file reads. Monitor logs for suspicious jumpUrl requests and attempted file access patterns.

Remediation

Patch, then assume compromise.

Upgrade TYPO3 to a fixed release. The advisory indicates fixed versions are 4.0.12 or later in the 4.0 branch, 4.1.10 or later in the 4.1 branch, and 4.2.6 or later in the 4.2 branch. Affected 3.3.x through 3.8.x installations should be upgraded to a supported fixed release. Also ensure any unsupported or prerelease affected versions, including 4.3alpha1, are replaced with a patched supported version.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).

VALID 1 / 2 TOTALView more in app

typo3_sa_2009_002.rbMaturityWeaponizedFrameworkmetasploitVerified exploit

This repository contains a single Metasploit auxiliary module (typo3_sa_2009_002.rb) that exploits a file disclosure vulnerability (CVE-2009-0815) in the Typo3 CMS jumpUrl mechanism. The module works by sending a crafted HTTP request to the Typo3 instance to trigger an error message that leaks a required juHash value. It then uses this juHash to make a second request, allowing the attacker to download any file accessible to the web server user. The default target file is 'typo3conf/localconf.php', but any file path can be specified. The module is written in Ruby and leverages Metasploit's HttpClient mixin. The attack vector is network-based, requiring HTTP access to the vulnerable Typo3 instance. The repository is operational and provides a working exploit for file disclosure, not just detection.

Disclosed Feb 10, 2009rubynetwork

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

Typo3Cmsapplication

Typo3Typo3application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

No public activity tracked yet. Mallory keeps watching.

0 SOURCESView more in app

No public activity observed for this vulnerability.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity