PT-2021-22253 · Typo3 · Deferred Image Processing

Published 2021-08-13 · Updated 2021-08-30 · CVE-2021-38623

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions deferred image processing extension versions prior to 1.0.2 for TYPO3

Description The issue allows for Denial of Service via the FAL API due to disk consumption in the /var/transient directory. This occurs because of the wrong usage of the TYPO3 FAL API, which results in copies of processed files being saved to the /var/transient/ folder on every frontend request. This can lead to the webspace being filled up with image files by crafting a large amount of requests to the website.

Recommendations For deferred image processing extension versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the /var/transient directory or implementing measures to limit disk consumption in this directory until the update is applied.

Fix

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

CVE-2021-38623

GHSA-34JQ-548X-M2X9

Affected Products

Deferred Image Processing

References · 5

• https://typo3.org/security/advisory/typo3-ext-sa-2021-009 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-38623 · Security Note
• https://osv.dev/vulnerability/CVE-2021-38623 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-34jq-548x-m2x9 · Vendor Advisory
• https://github.com/webcoast-dk/deferred-image-processing · Note