CVE-2022-36104 (published 2022-09-13T18:15Z)

TYPO3 is an open source PHP based web content management system released under the GNU GPL. In affected versions requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as an error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. Users are advised to update to TYPO3 version 11.5.16 to resolve this issue. There are no known workarounds for this issue.

CVSS v3 base score: 7.5, HIGH (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Weakness information:
cwe_id: CWE-770
cwe_name: Allocation of Resources Without Limits or Throttling
description: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
extended_description: Code frequently has to work with limited resources, so programmers must be careful to ensure that resources are not consumed too quickly, or too easily.  Without use of quotas, resource limits, or other protection mechanisms, it can be easy for an attacker to consume many resources by rapidly making many requests, or causing larger resources to be used than is needed. When too many resources are allocated, or if a single resource is too large, then it can prevent the code from working correctly, possibly leading to a denial of service.
         

Fix information:
repo_url: https://github.com/TYPO3/typo3
commit_details: repo_url: https://github.com/TYPO3/typo3
author: Oliver Hader
author_date: 2022-09-13 10:07:58+02:00
msg: [SECURITY] Mitigate denial-of-service scenarios in page error handler

This fixes TYPO3-CORE-SA-2021-005 again, which accidentally had
been removed during TYPO3 v11 development. An inaccessible error
page amplified potential denial-of-service scenarios.

Resolves: #97818
Releases: main, 11.5
Change-Id: Ia9c666731f70db5e0a60572cd008f1d0c541af37
Security-Bulletin: TYPO3-CORE-SA-2022-006
Security-References: CVE-2022-36104
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/75715
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>
repository: repo_url: https://github.com/TYPO3/typo3
repo_name: TYPO3/typo3
description: The TYPO3 Core - Enterprise Content Management System. Synchronized mirror of https://review.typo3.org/q/project:Packages/TYPO3.CMS
repo_language: PHP
owner: TYPO3
file_changes: filename: PageContentErrorHandler.php
change_type: ModificationType.MODIFY
diff: @@ -95,6 +95,13 @@ class PageContentErrorHandler implements PageErrorHandlerInterface
             $urlParams['pageuid'] = (int)($urlParams['pageuid'] ?? 0);
             $resolvedUrl = $this->resolveUrl($request, $urlParams);
 
+            // avoid denial-of-service amplification scenario
+            if ($resolvedUrl === (string)$request->getUri()) {
+                return new HtmlResponse(
+                    'The error page could not be resolved, as the error page itself is not accessible',
+                    $this->statusCode
+                );
+            }
             if ($this->useSubrequest) {
                 // Create a subrequest and do not take any special query parameters into account
                 $subRequest = $request->withQueryParams([])->withUri(new Uri($resolvedUrl))->withMethod('GET');

programming_language: PHP