PT-2021-21355 · Typo3 · Svg-Sanitizer+1

Lukas Eder + 1 · Published 2021-08-13 · Updated 2022-02-10 · CVE-2021-36787

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions femanager extension versions prior to 5.5.1 femanager extension versions 6.x prior to 6.3.1

Description The issue allows for Cross-Site Scripting (XSS) via a crafted SVG document. By default, the extension permits logged-in frontend users to upload SVG files as new profile images, which can lead to XSS when the uploaded image is used on the website.

Recommendations For versions prior to 5.5.1, update to version 5.5.1 or later. For versions 6.x prior to 6.3.1, update to version 6.3.1 or later. As a temporary workaround, consider disabling SVG file uploads for frontend users until a patch is applied. If SVG uploads are necessary, use the TYPO3 extension svg sanitizer to prevent malicious SVG file uploads or set up a strict Content Security Policy for the destination folder of uploaded images.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-36787

GHSA-F3RF-V9QM-9C89

Affected Products

Femanager

Svg-Sanitizer

References · 14

• 🔥 http://seclists.org/fulldisclosure/2022/Jan/53 · Exploit
• 🔥 http://packetstormsecurity.com/files/165675/TYPO3-femanager-6.3.0-Cross-Site-Scripting.html · Exploit
• https://osv.dev/vulnerability/GHSA-f3rf-v9qm-9c89 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36787 · Security Note
• https://typo3.org/security/advisory/typo3-ext-sa-2021-010 · Patch
• https://osv.dev/vulnerability/CVE-2021-36787 · Vendor Advisory
• https://github.com/in2code-de/femanager · Note
• https://github.com/in2code-de/femanager/releases/tag/6.3.1 · Note
• https://github.com/in2code-de/femanager/commit/70f873c60f0e40ffd6a1300218ca368156fc1bf2 · Note
• https://t.me/cibsecurity/27317 · Telegram Post
• https://t.me/defcon_news/94966 · Telegram Post
• https://t.me/cvenotify/25801 · Telegram Post
• https://typo3.org/help/security-advisories/security · Note
• https://extensions.typo3.org/extension/femanager · Note