TYPO3 Denial of Service in Online Media Asset Handling
Summary
GHSA-29m4-mx89-3mjg: TYPO3 Denial of Service in Online Media Asset Handling. Affects typo3/cms-core across 3 version ranges.
>= 7.0.0, < 7.6.32
>= 8.0.0, < 8.7.21
>= 9.0.0, < 9.5.2
Fixed in 7.6.32, 8.7.21 or 9.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) that allows users to create and manage websites. It provides various features and functionalities, including online media asset handling. This feature enables users to upload and manage media files, such as YouTube and Vimeo videos, within the TYPO3 backend. However, a vulnerability has been discovered in the online media asset handling component, which can lead to a denial of service (DoS) attack. This vulnerability affects the TYPO3 CMS Core package.
Vulnerability Detail
The vulnerability in TYPO3's online media asset handling component allows an attacker to cause a denial of service by uploading large files with specific file extensions (*.youtube and *.vimeo). When these large files are uploaded, it consumes a significant amount of system resources, potentially exceeding the limits of the current PHP process. As a result, the backend component becomes dysfunctional, impacting the overall functionality of the TYPO3 backend. Exploiting this vulnerability requires a valid backend user account or write access on the server system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.6.327.6.32composer require typo3/cms-core:7.6.32 -
>= 8.0.0, < 8.7.218.7.21composer require typo3/cms-core:8.7.21 -
>= 9.0.0, < 9.5.29.5.2composer require typo3/cms-core:9.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, TYPO3 users can restrict access to the online media asset handling component by implementing access controls or disabling the feature entirely. This can be done by modifying the TYPO3 configuration or using access control mechanisms provided by the server system. However, it is recommended to apply the official fix by updating the TYPO3 CMS Core package to the fixed versions mentioned above.
Conclusion
The vulnerability in TYPO3's online media asset handling component can be mitigated by updating the TYPO3 CMS Core package to the recommended fixed versions. Additionally, implementing access controls or disabling the feature temporarily can serve as a workaround. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 is an open-source content management system (CMS) used for creating and managing websites.
The online media asset handling component in TYPO3 allows users to upload and manage media files, such as YouTube and Vimeo videos, within the TYPO3 backend.
A denial of service (DoS) attack is a malicious attempt to disrupt the normal functioning of a system or network by overwhelming it with a flood of illegitimate requests or excessive resource consumption.
An attacker can exploit this vulnerability by uploading large files with the file extensions *.youtube or *.vimeo, causing high consumption of system resources and leading to a dysfunctional backend component.
For TYPO3 CMS Core version 8.x, users should update to version 8.7.21 or later. For TYPO3 CMS Core version 9.x, users should update to version 9.5.2 or later.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
