TYPO3 Direct Mail TSConfig Injection Enables Code Execution

An issue was discovered in the direct_mail (aka Direct Mail) extension through 9.5.1 for TYPO3. The Configuration backend module of the extension allows an authenticated user to write to an arbitrary TSConfig page for folders configured as Direct Mail. Exploiting this may lead to Configuration Injection (TYPO3 10.4 and above) and to Arbitrary Code Execution (TYPO3 9.5 and below). A valid backend user account, with access to the Direct Mail Configuration backend module, is needed to exploit this.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2023-50461 is a privilege escalation vulnerability in the TYPO3 Direct Mail extension that allows authenticated backend users to inject arbitrary configuration into TSConfig files. This vulnerability affects TYPO3 instances running Direct Mail through version 9.5.1, with severity varying by TYPO3 version: configuration injection on 10.4+, and arbitrary code execution on 9.5 and below. The vulnerability is particularly dangerous because it requires only valid backend credentials—a lower barrier than unauthenticated exploits—yet can lead to full system compromise through code execution. Organizations using Direct Mail for newsletter management are at risk, especially those with multiple backend users or contractors who may have legitimate access but malicious intent.

Casky's 283 mapped skills detect this attack pattern by analyzing both privilege escalation (TA0004) and credential access (TA0006) techniques through Claude AI's extended reasoning capabilities. Practitioners would observe findings highlighting unauthorized TSConfig modifications in backend audit logs, suspicious configuration parameter changes in Direct Mail settings, and unexpected code execution patterns in TYPO3 logs. The platform would flag the critical combination of backend authentication followed by system configuration tampering—the hallmark of post-compromise lateral movement. Security teams using Casky would receive alerts on attempts to write to restricted configuration files, particularly when originating from Direct Mail module access, enabling detection before arbitrary code execution occurs.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2023-50461.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2023-50461

Casky has 283 skills that investigate the attack patterns behind CVE-2023-50461. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn