CVE-2021-21355: Unrestricted File Upload in Form Framework
Problem Due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default fileDenyPattern successfully blocked files like .htaccess or malicious.php.
TYPO3 Extbase extensions, which implement a file upload and do not implement a custom TypeConverter to transform uploaded files into FileReference domain model objects are affected by the vulnerability as well, since the UploadedFileReferenceConverter of ext:form handles the file upload and will accept files of any mime-type which are persisted to the default location.
In any way, uploaded files are placed in the default location /fileadmin/userupload/, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information.
No authentication is required to exploit this vulnerability.
Solution Update to TYPO3 versions 8.7.40, 9.5.25, 10.4.14, 11.1.1 that fix the problem described.
Type converter UploadedFileReferenceConverter is not registered globally anymore and just handles uploaded files within the scope of the Form Framework. Guessable storage location has changed from /fileadmin/userupload/form\\<random-hash\>/ to /fileadmin/formuploads/<random-40-bit>. Allowed mime-types must match expected file extensions (e.g. application/pdf must be .pdf, and cannot be .html).
Extbase extensions, who rely on the global availability of the UploadedFileReferenceConverter must now implement a custom TypeConverter to handle file uploads or explicitly implement the ext:form UploadedFileReferenceConverter with appropriate setting for accepted mime-types.
Credits Thanks to Sebastian Michaelsen, Marc Lindemann, Oliver Eglseder, Markus Volkmer, Jakob Kunzmann, Johannes Regner, Richie Lee who reported this issue, and to TYPO3 core & security team members Oliver Hader & Benni Mack, as well as TYPO3 contributor Ralf Zimmermann who fixed the issue.
References TYPO3-CORE-SA-2021-002
Other sources
TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 8.7.40, 9.5.25, 10.4.14, 11.1.1, due to the lack of ensuring file extensions belong to configured allowed mime-types, attackers can upload arbitrary data with arbitrary file extensions - however, default fileDenyPattern successfully blocked files like .htaccess or malicious.php. Besides that, UploadedFileReferenceConverter transforming uploaded files into proper FileReference domain model objects handles possible file uploads for other extensions as well - given those extensions use the Extbase MVC framework, make use of FileReference items in their direct or inherited domain model definitions and did not implement their own type converter. In case this scenario applies, UploadedFileReferenceConverter accepts any file mime-type and persists files in the default location. In any way, uploaded files are placed in the default location /fileadmin/userupload/, in most scenarios keeping the submitted filename - which allows attackers to directly reference files, or even correctly guess filenames used by other individuals, disclosing this information. No authentication is required to exploit this vulnerability. This is fixed in versions 8.7.40, 9.5.25, 10.4.14, 11.1.1.
— MITRE
TYPO3-CORE-SA-2021-002: Unrestricted File Upload in Form Framework
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this TYPO3 vulnerability?
The vulnerability ID is CVE-2021-21355.
What is the severity level of CVE-2021-21355?
The severity level of CVE-2021-21355 is high.
Which versions of TYPO3 are affected by this vulnerability?
Versions 8.7.40, 9.5.25, 10.4.14, and 11.1.1 of TYPO3 are affected by this vulnerability.
Is there a fix available for CVE-2021-21355?
Yes, there are fixes available for CVE-2021-21355. Please refer to the official TYPO3 security advisory for more information.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability in the TYPO3 security advisory and the GitHub security advisory mentioned in the references.