=====================================================================

                             CERT-Renater

                 Note d'Information No. 2021/VULN509
_____________________________________________________________________

DATE                : 05/10/2021

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running TYPO3 CMS versions prior to 11.5.0.

=====================================================================
https://typo3.org/security/advisory/typo3-core-sa-2021-015
https://typo3.org/security/advisory/typo3-core-sa-2021-014
_____________________________________________________________________

 Tue. 5th October, 2021
TYPO3-CORE-SA-2021-015: HTTP Host Header Injection in Request Handling
Categories: Development, Security Created by Oliver Hader


It has been discovered that TYPO3 CMS is vulnerable to HTTP header
injection.

    Component Type: TYPO3 CMS
    Subcomponent: Request Handling (ext:core)
    Release Date: October 5, 2021
    Vulnerability Type: HTTP Header Injection
    Affected Versions: 11.0.0-11.4.0
    Severity: Low
    Suggested CVSS:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N/E:F/RL:O/RC:C
    References: CVE-2021-41114, CWE-20, CWE-644


Problem Description

It has been discovered that TYPO3 CMS is susceptible to host spoofing
due to improper validation of the HTTP Host header. TYPO3 uses the HTTP
Host header, for example, to generate absolute URLs during the frontend
rendering process. Since the host header itself is provided by the
client, it can be forged to any value, even in a name-based virtual
hosts environment.

This vulnerability is the same as described in TYPO3-CORE-SA-2014-001
(CVE-2014-3941). A regression, introduced during TYPO3 v11 development,
led to this situation. The already existing setting
$GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an
effective mitigation strategy in previous TYPO3 versions) was not
evaluated anymore, and reintroduced the vulnerability.


Solution

Update your instance to TYPO3 version 11.5.0 which addresses the problem
described.


Credits

Thanks to TYPO3 framework merger Benjamin Franzke who reported and fixed
the issue.


General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.
Please subscribe to the typo3-announce mailing list.


General Note

All security related code changes are tagged so that you can easily look
them up in our review system.

_________________________________________________________________________

 Tue. 5th October, 2021
TYPO3-CORE-SA-2021-014: Cross-Site-Request-Forgery in Backend URI Handling
Categories: Development, Security Created by Oliver Hader

It has been discovered that TYPO3 CMS is vulnerable to
cross-site-request-forgery.

    Component Type: TYPO3 CMS
    Subcomponent: Backend URI Handling (ext:backend)
    Release Date: October 5, 2021
    Vulnerability Type: Cross-Site-Request-Forgery
    Affected Versions: 11.2.0-11.4.0
    Severity: High
    Suggested CVSS:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
    References: CVE-2021-41113, CWE-352


Problem Description

It has been discovered that the new TYPO3 v11 feature that allows users
to create and share deep links in the backend user interface is
vulnerable to cross-site-request-forgery.

The impact is the same as described in TYPO3-CORE-SA-2020-006
(CVE-2020-11069). However, it is not limited to the same site context
and does not require the attacker to be authenticated. In a worst case
scenario, the attacker could create a new admin user account to
compromise the system.

To successfully carry out an attack, an attacker must trick his victim
to access a compromised system. The victim must have an active session
in the TYPO3 backend at that time.

The following Same-Site cookie settings in
$GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite] are required for an attack
to be successful:

    SameSite=strict: malicious evil.example.org invoking TYPO3
application at www.example.org
    SameSite=lax or none: malicious evil.com invoking TYPO3 application
at example.org


Solution

Update your instance to TYPO3 version 11.5.0 which addresses the problem
described.


Credits

Thanks to Richie Lee who reported this issue and to TYPO3 core &
security team members Benni Mack and Oliver Hader who fixed the issue.


General Advice

Follow the recommendations that are given in the TYPO3 Security Guide.
Please subscribe to the typo3-announce mailing list.


General Note

All security related code changes are tagged so that you can easily look
them up in our review system.



=========================================================
+ CERT-RENATER       |    tel : 01-53-94-20-44          +
+ 23/25 Rue Daviel   |    fax : 01-53-94-20-41          +
+ 75013 Paris        |    email:cert@support.renater.fr +
=========================================================