--- title: "TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode" url: "https://news.typo3.com/security/advisory/typo3-psa-2020-002" description: Accessing Install Tool via TYPO3 Backend requires password verification - known as Sudo Mode. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - "Product Updates & Roadmap" - Public Service Announcement --- # TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - [Product Updates & Roadmap](https://news.typo3.com/article/category/product-updates-roadmap) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2020-002: Protecting Install Tool with Sudo Mode ========================================================== 17 November 2020 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) Accessing Install Tool via TYPO3 Backend requires password verification - known as Sudo Mode. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - **Component Type:** TYPO3 CMS - **Subcomponent:** Install Tool (ext:install) - **Release Date:** November 17, 2020 - **Affected Versions:** 9.0.0-9.5.22, 10.0.0-10.4.9 ### Problem Description When the system maintainer concept was introduced with TYPO3 v9.0.0 the necessity of having to enter a password when accessing the Install Tool via backend user interface was removed. However, the Install Tool allows one to define various configurations as well as arguments and paths for low-level binary applications to take care of further processing. Per definition, all of these actions and features qualify as “remote code execution”. There is no problem when those are used by valid system maintainers - however, it also could be used as a valid attack vector in case user sessions have been hijacked by other vulnerabilities in any software component on the same server - such as cross-site scripting or SQL injection. ### Solution The ideal solution would be to omit the presence of the Install Tool component on a website in production - which is however not feasible for all environments. Thus, protecting the entry point is currently the best way to mitigate unintentional access to the Install Tool via the backend user interface. Users now have to enter either their user password or the “Install Tool password” to get corresponding access. This mechanism is known as *Sudo Mode*. It is suggested to update to TYPO3 versions 9.5.23 or 10.4.10 that mitigate the problem described by introducing *Sudo Mode* for accessing the Install Tool via the backend user interface. Maintainers of extensions that provide remote, single sign-on, or multi-factor authentication are advised to [check technical details and potential implications for their extensions](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/9.5.x/Important-92836-IntroduceSudoModeForInstallToolAccessedViaBackend.html). This change is enforcing the suggestions of [TYPO3-CORE-SA-2020-006](https://typo3.org/security/advisory/typo3-core-sa-2020-006). ### Credits Thanks to Sinan Sekerci (Dreamlab Technologies) who brought this topic again to our attention and to TYPO3 security team member Oliver Hader who introduced *Sudo Mode* to mitigate the issue. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)