TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController
Package
Affected versions
>= 9.0.0, <= 9.5.47
>= 10.0.0, <= 10.4.44
>= 11.0.0, <= 11.5.36
>= 12.0.0, <= 12.4.14
>= 13.0.0, <= 13.1.0
Patched versions
9.5.48
10.4.45
11.5.37
12.4.15
13.1.1
Description
Published by the National Vulnerability Database
May 14, 2024
Published to the GitHub Advisory Database
May 14, 2024
Reviewed
May 14, 2024
Last updated
May 14, 2024
Problem
The
ShowImageController(eID tx_cms_showpic) lacks a cryptographic HMAC-signature on theframeHTTP query parameter (e.g./index.php?eID=tx_cms_showpic?file=3&...&frame=12345).This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side.
Solution
Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described.
ℹ️ Strong security defaults - Manual actions required
The
frameHTTP query parameter is now ignored, since it could not be used by core APIs.The new feature flag
security.frontend.allowInsecureFrameOptionInShowImageController– which is disabled per default – can be used to reactivate the previous behavior.Credits
Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team members Benjamin Mack and Benjamin Franzke who fixed the issue.
References
References