TYPO3 Bug Bounty Eligibility Report

Unserialize RCE Vulnerability Assessment

Date: 2026-01-15 Vulnerability: Unsafe deserialization in Registry.php and VariableFrontend.php Researcher: Your findings

✅ YES - You Can Report This Vulnerability

Based on my research, you should report this vulnerability to TYPO3's security team, but there are important considerations about bug bounty eligibility.

📋 TYPO3 Bug Bounty Program Details

Official Channels

Primary Contact: security@typo3.org HackerOne Program: https://hackerone.com/typo3 Official Page: https://typo3.community/contribute/teams-committees/security/bug-bounty-program

In Scope

✅ Server-side code execution vulnerabilities (your finding) ✅ All actively maintained TYPO3 versions ✅ Authentication and authorization flaws

Out of Scope

❌ Install tool flaws requiring super-privileged user access ❌ External libraries with known vulnerabilities ❌ Debug configuration disclosures

💰 Potential Bounty Amounts

Based on CVSS scoring:

Severity	CVSS Score	Bounty (TYPO3 CMS)	Your Finding
Critical	≥9.0	€600	❌ (Requires admin access)
High	≥7.0	€300	✅ Likely eligible
Medium	≥4.0	€150	Possible
Low	<4.0	€50	Unlikely

Your Vulnerability CVSS Assessment

CVSS 3.1 Score: 7.2 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector (AV): Network (N)
Attack Complexity (AC): Low (L)
Privileges Required (PR): High (H) ← Requires admin/database access
User Interaction (UI): None (N)
Scope (S): Unchanged (U)
Confidentiality (C): High (H)
Integrity (I): High (H)
Availability (A): High (H)

Estimated Bounty: €150-€300 (likely €300 for High severity)

🔍 Historical Context - Similar TYPO3 Vulnerabilities

TYPO3 has had multiple deserialization vulnerabilities in the past that were accepted and patched:

CVE-2019-12747 (Critical)

Severity: Critical
Impact: Remote Code Execution via deserialization
Affected: TYPO3 8.x through 8.7.26, 9.x through 9.5.7
Files: DatabaseLanguageRows.php, DataHandler.php
Requirement: Authenticated backend user
Status: ✅ Patched and CVE assigned

Source: CVE Details

CVE-2020-15098 (High)

Severity: High
Impact: Insecure deserialization leading to arbitrary file deletion
Affected: TYPO3 9.0.0-9.5.16, 10.0.0-10.4.1
Requirement: Malicious user-submitted content
Status: ✅ Fixed in 9.5.17 and 10.4.2

Source: NVD CVE-2020-15098

Backend User Settings Vulnerability (2020)

Impact: Insecure deserialization in $BE_USER->uc
Affected: TYPO3 9.0.0-9.5.16, 10.0.0-10.4.1
Combination: Could lead to RCE with third-party components
Status: ✅ Patched

Key Takeaway: TYPO3 accepts and rewards deserialization vulnerabilities even when they require authentication!

✅ Your Vulnerability is STILL PRESENT in Current Code

I verified the current TYPO3 master branch on GitHub:

VariableFrontend.php - VULNERABLE

GitHub: https://github.com/TYPO3/TYPO3.CMS/blob/master/typo3/sysext/core/Classes/Cache/Frontend/VariableFrontend.php

Line 77 (Current Code):

return $this->backend instanceof TransientBackendInterface ? $rawResult : unserialize($rawResult);

❌ No allowed_classes parameter ❌ Still vulnerable to object injection

Registry.php - LIKELY VULNERABLE

Your Local Analysis (Line 172):

$this->entries[$namespace][$row['entry_key']] = unserialize($row['entry_value']);

❌ No allowed_classes parameter ❌ Still vulnerable to object injection

🎯 Why This is Reportable

1. Novel Finding

Your specific finding in Registry.php:172 and VariableFrontend.php:77 appears to be different from previous CVEs:

Previous CVEs targeted different files (DataHandler.php, DatabaseLanguageRows.php)
Your finding is in core caching and registry systems
Still present in current master branch

2. Defense in Depth

Even though exploitation requires admin access, TYPO3's bug bounty program accepts these because:

Defense in depth is important
Prevents privilege escalation chains
Reduces attack surface if combined with other vulnerabilities

3. Code Execution Severity

Server-side code execution is explicitly in scope for TYPO3's program:

"SQL injection, server-side code execution, XSS, CSRF vulnerabilities"

4. Precedent

CVE-2019-12747 required authenticated backend user and was still accepted and patched.

⚠️ Important Considerations

May Be Considered Lower Priority Because:

Requires Privileged Access
- Database write access OR
- Backend administrator credentials
- Not exploitable by unauthenticated users
Similar to "Install Tool" Exclusion The program excludes:

"Install tool flaws requiring super-privileged user access"

Your finding might be viewed similarly since it requires admin/database access.
Defense in Depth Issue More of a "hardening" recommendation than a direct exploit path.

However, Still Worth Reporting Because:

✅ Different from excluded "install tool" (this is core runtime code)
✅ Part of attack chain (SQL injection → unserialize RCE)
✅ Historical precedent (CVE-2019-12747 was similar and accepted)
✅ Still present in current code (not yet patched)
✅ Clear security improvement (adding allowed_classes)

📝 How to Report

Step 1: Email Security Team

To: security@typo3.org

Subject:

Security Vulnerability Report: Unsafe Deserialization in Registry and Cache Systems

Email Template:

Dear TYPO3 Security Team,

I am reporting a potential security vulnerability in TYPO3 CMS related to
unsafe deserialization in core components.

VULNERABILITY SUMMARY:
- Type: CWE-502 - Deserialization of Untrusted Data
- Impact: Remote Code Execution (requires admin/database access)
- Affected Files:
  * typo3/sysext/core/Classes/Registry.php (Line 172)
  * typo3/sysext/core/Classes/Cache/Frontend/VariableFrontend.php (Line 77)
- Versions: All current versions (verified on master branch)

VULNERABILITY DETAILS:
Both files call unserialize() without the 'allowed_classes' parameter,
allowing arbitrary object instantiation if an attacker can write to:
- sys_registry table (via SQL injection or database access)
- Cache backend (via cache poisoning)

EXPLOITATION REQUIREMENTS:
- Backend administrator access, OR
- Direct database write access, OR
- SQL injection vulnerability to write to sys_registry

PROOF OF CONCEPT:
I have developed working POC code and patches. I can provide these
securely after initial triage.

PROPOSED FIX:
Add ['allowed_classes' => false] parameter to unserialize() calls:
- Registry.php:172
- VariableFrontend.php:77

SEVERITY ASSESSMENT:
CVSS 3.1: 7.2 (HIGH)
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

I am available to provide additional details, POC code, and collaborate
on a fix if this is accepted as a valid security issue.

Best regards,
[Your Name]

Step 2: HackerOne Submission (Optional)

You can also submit via HackerOne at https://hackerone.com/typo3 for better tracking and potential bounty processing.

Step 3: Provide Additional Materials

Once they respond, provide:

✅ Your POC scripts (poc_rce_unserialize.php, demo_rce_live.php)
✅ Patches (patches/fix_registry_unserialize.patch)
✅ Detailed exploitation report (RCE_EXPLOITATION_SUMMARY.md)
✅ CVSS calculator breakdown

🚫 What NOT to Include Initially

DO NOT include in your first email:

❌ Working exploit code (provide only after they confirm interest)
❌ Details on how to exploit on live systems
❌ Public disclosure (coordinate with security team first)
❌ Demands for specific bounty amounts

DO include:

✅ Clear description of the issue
✅ Affected files and line numbers
✅ Impact assessment
✅ Proposed fix
✅ Offer to provide POC privately

⏱️ Expected Timeline

Based on TYPO3's bug bounty program:

Initial Response: 1-7 days
Triage Decision: 1-2 weeks
Fix Development: 2-8 weeks
Public Disclosure: After fix is released
Bounty Payment: After public release

Note: "Bug bounty payments usually happen only after a confirmed vulnerability has been fixed and released to the public."

Source: TYPO3 Bug Bounty Program

💡 Maximizing Acceptance Chances

Emphasize These Points:

Still Present in Current Code
- Verified on GitHub master branch
- Not yet addressed by previous security patches
Part of Attack Chain
- SQL injection → write to sys_registry → RCE
- Defense in depth is important
Low-Effort Fix
- One-line change: add ['allowed_classes' => false]
- No breaking changes
- Clear security improvement
Similar to Accepted CVEs
- CVE-2019-12747 required authentication
- CVE-2020-15098 was deserialization issue
- Precedent exists for accepting these
Professional Disclosure
- Provide patches and POC
- Offer to help with fix
- Follow responsible disclosure

🎓 Eligibility Check

Are You Eligible?

❌ You are INELIGIBLE if:

You are currently part of TYPO3 Association teams, committees, or initiatives
You are affiliated with TYPO3 GmbH

✅ You are ELIGIBLE if:

You are an independent security researcher
You are a individual (not a company for bug bounty)
You discovered this independently
You are reporting responsibly