PT-2021-19863 · Neos · Neos/Forms

Published 2021-06-21 · Updated 2021-06-29 · CVE-2021-32697

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions neos/forms versions prior to the version containing the fix for this issue

Description The issue allows a form to be submitted without invoking any validators by crafting a special GET request containing a valid form state. The form state is secured with an HMAC that is still verified, meaning this issue can only be exploited if Form Finishers cause side effects even if no form values have been sent. Form Finishers can be adjusted to only execute an action if the submitted form contains some expected data, or a custom Finisher can be added as the first finisher.

Recommendations For neos/forms, update to a version that includes the fix for this issue, as provided in the patch https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246. As a temporary workaround, consider adjusting Form Finishers to only execute an action if the submitted form contains some expected data. Alternatively, add a custom Finisher as the first finisher to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2021-32697

GHSA-M5VX-8CHX-QVMM

Affected Products

Neos/Forms

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/neos/form/CVE-2021-32697.yaml · Exploit
• https://github.com/neos/form/commit/69de4219b1f58157e2be6b05811463875d75c246 · Patch
• https://github.com/neos/form/commit/049d415295be8d4a0478ccba97dba1bb81649567 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32697 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32697 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-m5vx-8chx-qvmm · Vendor Advisory
• https://github.com/neos/form/releases/tag/5.1.3 · Note
• https://github.com/neos/form/security/advisories/GHSA-m5vx-8chx-qvmm · Note
• https://github.com/neos/form · Note
• https://t.me/cibsecurity/25582 · Telegram Post
• ❌ https://github.com/neos/form-ghsa-m5vx-8chx-qvmm/pull/1 · Note, Deleted