CVE-2021-38623: Improper Resource Shutdown or Release in TYPO3 extension
Summary
CVE-2021-3862: icecoder is vulnerable to Cross-site Scripting. Affects icecoder/icecoder versions < 8.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TYPO3 extension 'webcoast/deferred-image-processing' is a package available on Packagist. It provides functionality for deferred image processing in TYPO3 websites. This extension allows users to process images on the frontend of the website, optimizing them for display. However, a vulnerability has been discovered in the extension that can lead to a Denial of Service (DoS) attack.
Vulnerability Detail
The vulnerability arises from incorrect usage of the TYPO3 FAL API in the 'webcoast/deferred-image-processing' extension. Due to this flaw, copies of processed files are saved to the '/var/transient/' folder of a TYPO3 website on every frontend request. An attacker can exploit this vulnerability by crafting a large number of requests to the website, causing the webspace to be filled up with image files. This can result in a DoS condition, rendering the website inaccessible.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Conclusion
The 'webcoast/deferred-image-processing' TYPO3 extension is vulnerable to an improper resource shutdown or release issue. This can be exploited by attackers to launch a Denial of Service (DoS) attack on TYPO3 websites. To mitigate this vulnerability, users should update the package to version 1.0.2 or later. It is also recommended to use the Vulert Playground at https://vulert.com/scanner to check if your application is affected by this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for icecoder/icecoder →
FAQ
The vulnerability can lead to a Denial of Service (DoS) attack on TYPO3 websites. Attackers can fill up the webspace by crafting a large number of requests, rendering the website inaccessible.
No, there is no known workaround for this vulnerability. It is recommended to update the 'webcoast/deferred-image-processing' package to the latest version.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply upload your composer.lock file and Vulert will analyze it for any open-source vulnerabilities, including this one.
The CVSS score of this vulnerability is 7.0, indicating a high severity level.
For further support on vulnerability remediation, you can contact info@devnack.com. They can provide guidance and assistance in fixing this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for icecoder/icecoder.
