PT-2021-14440 · Typo3 · Typo3

Richie Lee · Published 2021-03-23 · Updated 2024-03-06 · CVE-2021-21357

Positive Technologies (AI Summary)

CVSS v3.1

8.3

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Name of the Vulnerable Software and Affected Versions TYPO3 versions prior to 8.7.40, 9.5.25, 10.4.14, 11.1.1

Description The issue arises from improper input validation, allowing attackers to bypass restrictions of predefined options and submit arbitrary data in the Form Designer backend module of the Form Framework. This enables attackers to explicitly allow arbitrary mime-types for file uploads. Although the default fileDenyPattern successfully blocks files like .htaccess or malicious.php, attackers can still persist those files in any writable directory of the corresponding TYPO3 installation. A valid backend user account with access to the form module is needed to exploit this vulnerability.

Recommendations Update to TYPO3 version 8.7.40 to fix the issue. Update to TYPO3 version 9.5.25 to fix the issue. Update to TYPO3 version 10.4.14 to fix the issue. Update to TYPO3 version 11.1.1 to fix the issue.

Exploit

Fix

Unrestricted File Upload

RCE

Path traversal

Weakness Enumeration

CWE-434

CWE-20

CWE-22

Related Identifiers

BIT-TYPO3-2021-21357

CVE-2021-21357

GHSA-3VG7-JW9M-PC3F

Affected Products

Typo3

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-21357.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-21357.yaml · Exploit
• https://osv.dev/vulnerability/BIT-typo3-2021-21357 · Vendor Advisory
• https://typo3.org/security/advisory/typo3-core-sa-2021-003 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21357 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21357 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3vg7-jw9m-pc3f · Vendor Advisory
• https://github.com/TYPO3/TYPO3.CMS/security/advisories/GHSA-3vg7-jw9m-pc3f · Note
• https://t.me/cibsecurity/25274 · Telegram Post
• https://packagist.org/packages/typo3/cms-form · Note