Skip to content
Nuclei Templates

Typo3 composer.json Exposure

ID: typo3-composer

Severity: low

Author: 0x_Akoko

Tags: typo3,cms,exposure,misconfig

Description

Section titled “Description”

The web application is based on Typo3 CMS. A sensitive file has been found. Access to such files must be restricted, as it may lead to disclosure of sensitive information about the web application.

YAML Source

Section titled “YAML Source”
id: typo3-composer


info:
  name: Typo3 composer.json Exposure
  author: 0x_Akoko
  severity: low
  description: |
    The web application is based on Typo3 CMS. A sensitive file has been found. Access to such files must be restricted, as it may lead to disclosure of sensitive information about the web application.
  reference:
    - https://docs.typo3.org/c/typo3/cms-core/main/en-us/Changelog/9.0/Breaking-83302-ComposerRestrictsInstallationOfTypo3cms.html
  classification:
    cpe: cpe:2.3:a:typo3:typo3:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: typo3
    product: typo3
    shodan-query: "X-TYPO3-Parsetime: 0ms"
  tags: typo3,cms,exposure,misconfig


http:
  - method: GET
    path:
      - '{{BaseURL}}/typo3/sysext/install/composer.json'


    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "The Install Tool mounted as the module Tools>Install in TYPO3."
          - "typo3-cms-framework"
        condition: and


      - type: status
        status:
          - 200
# digest: 490a004630440220275d67f0a4039933700ed0858652b535ff7ea0224426cda4896758a4a6ada23802206d8042671d824a2998d7242f76e91510e16a3e5a2143c057cbba6d8cce1b3ce8:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/misconfiguration/typo3-composer.yaml"

View on Github