GHSA-4p9g-qgx9-397pmedium5.9

Denial of Service in Page Error Handling

The advisory, in context

Meta

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H/E:F/RL:O/RC:C (5.5)

CWE-405, CWE-674

Status: DRAFT

Problem

Requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded.

Solution

Update to TYPO3 versions 9.5.25, 10.4.14, 11.1.1 that fix the problem described.

Credits

Thanks to Paul Keller, Mathias Bolt Lesniak and Kay Strobach who reported this issue and to TYPO3 framework merger Frank Nägler and to TYPO3 security team member Torben Hansen who fixed the issue.

References

TYPO3-CORE-SA-2021-005

Affected packages

Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.

typo3/cms-core Packagist

Ecosystem versions

From 10.0.0 before 10.4.14

Fixed in 10.4.14

20 explicitly affected versions

v10.0.0, v10.1.0, v10.2.0, v10.2.1, v10.2.2, v10.3.0, v10.4.0, v10.4.1, v10.4.10, v10.4.11, v10.4.12, v10.4.13, v10.4.2, v10.4.3, v10.4.4, v10.4.5, v10.4.6, v10.4.7, v10.4.8, v10.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "10.0.0"
        },
        {
          "fixed": "10.4.14"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v10.0.0",
    "v10.1.0",
    "v10.2.0",
    "v10.2.1",
    "v10.2.2",
    "v10.3.0",
    "v10.4.0",
    "v10.4.1",
    "v10.4.10",
    "v10.4.11",
    "v10.4.12",
    "v10.4.13",
    "v10.4.2",
    "v10.4.3",
    "v10.4.4",
    "v10.4.5",
    "v10.4.6",
    "v10.4.7",
    "v10.4.8",
    "v10.4.9"
  ]
}

typo3/cms-core Packagist

Ecosystem versions

From 11.0.0 before 11.1.1

Fixed in 11.1.1

2 explicitly affected versions

v11.0.0, v11.1.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "11.0.0"
        },
        {
          "fixed": "11.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v11.0.0",
    "v11.1.0"
  ]
}

typo3/cms-core Packagist

Ecosystem versions

From 9.0.0 before 9.5.25

Fixed in 9.5.25

34 explicitly affected versions

v9.0.0, v9.1.0, v9.2.0, v9.2.1, v9.3.0, v9.3.1, v9.3.2, v9.3.3, v9.4.0, v9.5.0, v9.5.1, v9.5.10, v9.5.11, v9.5.12, v9.5.13, v9.5.14, v9.5.15, v9.5.16, v9.5.17, v9.5.18, v9.5.19, v9.5.2, v9.5.20, v9.5.21, v9.5.22, v9.5.23, v9.5.24, v9.5.3, v9.5.4, v9.5.5, v9.5.6, v9.5.7, v9.5.8, v9.5.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "9.0.0"
        },
        {
          "fixed": "9.5.25"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v9.0.0",
    "v9.1.0",
    "v9.2.0",
    "v9.2.1",
    "v9.3.0",
    "v9.3.1",
    "v9.3.2",
    "v9.3.3",
    "v9.4.0",
    "v9.5.0",
    "v9.5.1",
    "v9.5.10",
    "v9.5.11",
    "v9.5.12",
    "v9.5.13",
    "v9.5.14",
    "v9.5.15",
    "v9.5.16",
    "v9.5.17",
    "v9.5.18",
    "v9.5.19",
    "v9.5.2",
    "v9.5.20",
    "v9.5.21",
    "v9.5.22",
    "v9.5.23",
    "v9.5.24",
    "v9.5.3",
    "v9.5.4",
    "v9.5.5",
    "v9.5.6",
    "v9.5.7",
    "v9.5.8",
    "v9.5.9"
  ]
}

typo3/cms Packagist

Ecosystem versions

From 10.0.0 before 10.4.14

Fixed in 10.4.14

20 explicitly affected versions

v10.0.0, v10.1.0, v10.2.0, v10.2.1, v10.2.2, v10.3.0, v10.4.0, v10.4.1, v10.4.10, v10.4.11, v10.4.12, v10.4.13, v10.4.2, v10.4.3, v10.4.4, v10.4.5, v10.4.6, v10.4.7, v10.4.8, v10.4.9

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "10.0.0"
        },
        {
          "fixed": "10.4.14"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v10.0.0",
    "v10.1.0",
    "v10.2.0",
    "v10.2.1",
    "v10.2.2",
    "v10.3.0",
    "v10.4.0",
    "v10.4.1",
    "v10.4.10",
    "v10.4.11",
    "v10.4.12",
    "v10.4.13",
    "v10.4.2",
    "v10.4.3",
    "v10.4.4",
    "v10.4.5",
    "v10.4.6",
    "v10.4.7",
    "v10.4.8",
    "v10.4.9"
  ]
}

typo3/cms Packagist

Ecosystem versions

From 11.0.0 before 11.1.1

Fixed in 11.1.1

2 explicitly affected versions

v11.0.0, v11.1.0

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "11.0.0"
        },
        {
          "fixed": "11.1.1"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v11.0.0",
    "v11.1.0"
  ]
}

typo3/cms Packagist

Ecosystem versions

From 9.0.0 before 9.5.25

Fixed in 9.5.25

34 explicitly affected versions

View affected-version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "9.0.0"
        },
        {
          "fixed": "9.5.25"
        }
      ],
      "type": "ECOSYSTEM"
    }
  ],
  "versions": [
    "v9.0.0",
    "v9.1.0",
    "v9.2.0",
    "v9.2.1",
    "v9.3.0",
    "v9.3.1",
    "v9.3.2",
    "v9.3.3",
    "v9.4.0",
    "v9.5.0",
    "v9.5.1",
    "v9.5.10",
    "v9.5.11",
    "v9.5.12",
    "v9.5.13",
    "v9.5.14",
    "v9.5.15",
    "v9.5.16",
    "v9.5.17",
    "v9.5.18",
    "v9.5.19",
    "v9.5.2",
    "v9.5.20",
    "v9.5.21",
    "v9.5.22",
    "v9.5.23",
    "v9.5.24",
    "v9.5.3",
    "v9.5.4",
    "v9.5.5",
    "v9.5.6",
    "v9.5.7",
    "v9.5.8",
    "v9.5.9"
  ]
}

Set up in your agent.

Investigate in your agent.

Denial of Service in Page Error Handling

The advisory, in context

Meta

Problem

Solution

Credits

References

Affected packages

References