PT-2021-14439 · Typo3 · Typo3

Jakob Kunzmann + 6 · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21355

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 8.7.40 TYPO3 versions prior to 9.5.25 TYPO3 versions prior to 10.4.14 TYPO3 versions prior to 11.1.1

Description The issue arises from the lack of ensuring file extensions belong to configured allowed mime-types, allowing attackers to upload arbitrary data with arbitrary file extensions. However, the default fileDenyPattern successfully blocks files like .htaccess or malicious.php. The UploadedFileReferenceConverter handles file uploads for extensions using the Extbase MVC framework and accepts any file mime-type, persisting files in the default location /fileadmin/user upload/. This allows attackers to directly reference files or guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this issue.

Recommendations Update to TYPO3 version 8.7.40 to resolve the issue. Update to TYPO3 version 9.5.25 to resolve the issue. Update to TYPO3 version 10.4.14 to resolve the issue. Update to TYPO3 version 11.1.1 to resolve the issue. For Extbase extensions that rely on the global availability of the UploadedFileReferenceConverter, implement a custom TypeConverter to handle file uploads or explicitly implement the ext:form UploadedFileReferenceConverter with appropriate settings for accepted mime-types.

Exploit

Fix

Unrestricted File Upload

Files Accessible to External Parties

Weakness Enumeration

CWE-434

CWE-552

Related Identifiers

BIT-TYPO3-2021-21355

CVE-2021-21355

GHSA-2R6J-862C-M2V2

Affected Products

Typo3

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21355.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21355.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-21355 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21355 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-2r6j-862c-m2v2 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-002 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-typo3-2021-21355 · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-2r6j-862c-m2v2 · Note
• https://t.me/cibsecurity/25272 · Telegram Post
• https://packagist.org/packages/typo3/cms-form · Note