CVE-2022-31047: Generation of Error Message Containing Sensitive Information (CWE-209)
value: TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, system internal credentials or keys (e.g. database credentials) can be logged as plaintext in exception handlers, when logging the complete exception stack trace. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 contain a fix for the problem.
CWE description: The product generates an error message that includes sensitive information about its environment, users, or associated data.
CVSS v3 base score: 6.5
Published: 2022-06-14T21:15Z
Repository: https://github.com/TYPO3/typo3
Language: PHP
Files changed: typo3/sysext/core/Classes/Error/AbstractExceptionHandler.php, typo3/sysext/core/Classes/Error/DebugExceptionHandler.php
Commit date: 2022-06-14 09:17:24 +0200
Commit message: [SECURITY] Do not log stacktrace in exception handlers

When a TYPO3 exception is handled through registered exception
handlers, log writers may log sensitive information to logs,
since the full stacktrace is logged.

With this change, exception handlers that extend
AbstractExceptionHandler except DebugExceptionHandler will
by default not include the exception object any more and
thereby not log the full stacktrace.

Resolves: #96866
Releases: main, 11.5, 10.4
Change-Id: Iaf233eefc9a1a60334a47753baf457e8282e68c0
Security-Bulletin: TYPO3-CORE-SA-2022-002
Security-References: CVE-2022-31047
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74903
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Diff: diff --git a/typo3/sysext/core/Classes/Error/AbstractExceptionHandler.php b/typo3/sysext/core/Classes/Error/AbstractExceptionHandler.php
index 01ee11ecd8b..75d3072ca36 100644
--- a/typo3/sysext/core/Classes/Error/AbstractExceptionHandler.php
+++ b/typo3/sysext/core/Classes/Error/AbstractExceptionHandler.php
@@ -38,10 +38,12 @@ abstract class AbstractExceptionHandler implements ExceptionHandlerInterface, Si
     use LoggerAwareTrait;
 
     const CONTEXT_WEB = 'WEB';
     const CONTEXT_CLI = 'CLI';
 
+    protected bool $logExceptionStackTrace = false;
+
     private const IGNORED_EXCEPTION_CODES = [
         1396795884, // Current host header value does not match the configured trusted hosts pattern
         1581862822, // Failed HMAC validation due to modified __trustedProperties in extbase property mapping
         1581862823, // Failed HMAC validation due to modified form state in ext:forms
         1616175867, // Backend login request is rate limited
@@ -96,11 +98,11 @@ abstract class AbstractExceptionHandler implements ExceptionHandlerInterface, Si
                     'exception_code' => $exception->getCode(),
                     'file' => $exception->getFile(),
                     'line' => $exception->getLine(),
                     'message' => $exception->getMessage(),
                     'request_url' => $requestUrl,
-                    'exception' => $exception,
+                    'exception' => $this->logExceptionStackTrace ? $exception : null,
                 ]);
             }
         } catch (\Exception $exception) {
             // A nested exception here was probably caused by a database failure, which means there's little
             // else that can be done other than moving on and letting the system hard-fail.
diff --git a/typo3/sysext/core/Classes/Error/DebugExceptionHandler.php b/typo3/sysext/core/Classes/Error/DebugExceptionHandler.php
index 1751d888685..61abbf1d762 100644
--- a/typo3/sysext/core/Classes/Error/DebugExceptionHandler.php
+++ b/typo3/sysext/core/Classes/Error/DebugExceptionHandler.php
@@ -24,10 +24,12 @@ use TYPO3\CMS\Core\Information\Typo3Information;
  * falls through the other exception handlers and provides useful debugging
  * information.
  */
 class DebugExceptionHandler extends AbstractExceptionHandler
 {
+    protected bool $logExceptionStackTrace = true;
+
     /**
      * Constructs this exception handler - registers itself as the default exception handler.
      */
     public function __construct()
     {

Vulnerable code:                     'exception' => $exception,
Fixed code:     protected bool $logExceptionStackTrace = false;

                    'exception' => $this->logExceptionStackTrace ? $exception : null,
    protected bool $logExceptionStackTrace = true;