CVE-2022-36104: Allocation of Resources Without Limits or Throttling (CWE-770)
value: TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.
CWE description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
CVSS v3 base score: 7.5
Published: 2022-09-13T18:15Z
Repository: https://github.com/TYPO3/typo3
Language: PHP
Files changed: typo3/sysext/core/Classes/Error/PageErrorHandler/PageContentErrorHandler.php
Commit date: 2022-09-13 10:08:02 +0200
Commit message: [SECURITY] Mitigate denial-of-service scenarios in page error handler

This fixes TYPO3-CORE-SA-2021-005 again, which accidentally had
been removed during TYPO3 v11 development. An inaccessible error
page amplified potential denial-of-service scenarios.

Resolves: #97818
Releases: main, 11.5
Change-Id: Ia9c666731f70db5e0a60572cd008f1d0c541af37
Security-Bulletin: TYPO3-CORE-SA-2022-006
Security-References: CVE-2022-36104
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75715
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>

Diff: diff --git a/typo3/sysext/core/Classes/Error/PageErrorHandler/PageContentErrorHandler.php b/typo3/sysext/core/Classes/Error/PageErrorHandler/PageContentErrorHandler.php
index aaab8091dd23..b5c8e85ef549 100644
--- a/typo3/sysext/core/Classes/Error/PageErrorHandler/PageContentErrorHandler.php
+++ b/typo3/sysext/core/Classes/Error/PageErrorHandler/PageContentErrorHandler.php
@@ -93,10 +93,17 @@ class PageContentErrorHandler implements PageErrorHandlerInterface
         try {
             $urlParams = $this->link->resolve($this->errorHandlerConfiguration['errorContentSource']);
             $urlParams['pageuid'] = (int)($urlParams['pageuid'] ?? 0);
             $resolvedUrl = $this->resolveUrl($request, $urlParams);
 
+            // avoid denial-of-service amplification scenario
+            if ($resolvedUrl === (string)$request->getUri()) {
+                return new HtmlResponse(
+                    'The error page could not be resolved, as the error page itself is not accessible',
+                    $this->statusCode
+                );
+            }
             if ($this->useSubrequest) {
                 // Create a subrequest and do not take any special query parameters into account
                 $subRequest = $request->withQueryParams([])->withUri(new Uri($resolvedUrl))->withMethod('GET');
                 $subResponse = $this->stashEnvironment(fn (): ResponseInterface => $this->sendSubRequest($subRequest, $urlParams['pageuid']));
             } else {

Fixed code:             // avoid denial-of-service amplification scenario
            if ($resolvedUrl === (string)$request->getUri()) {
                return new HtmlResponse(
                    'The error page could not be resolved, as the error page itself is not accessible',
                    $this->statusCode
                );
            }