CVE-2021-21355: 
PHP vulnerability analysis and mitigation

TYPO3, an open source PHP-based web content management system, was found to contain a file upload vulnerability (CVE-2021-21355) affecting versions prior to 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The vulnerability was disclosed on March 16, 2021, and received a CVSS v3.1 base score of 8.6 (HIGH) (NIST NVD).

The vulnerability stems from the lack of proper validation ensuring file extensions belong to configured allowed mime-types. The UploadedFileReferenceConverter component, which transforms uploaded files into FileReference domain model objects, accepts any file mime-type and persists files in the default location. While the default fileDenyPattern successfully blocked malicious files like .htaccess or .php, attackers could still upload arbitrary data with arbitrary file extensions. Files are stored in /fileadmin/user_upload/, typically maintaining the submitted filename (TYPO3 Advisory).

The vulnerability allows attackers to upload arbitrary files and potentially access or guess filenames used by other users, leading to information disclosure. Additionally, the flaw affects TYPO3 Extbase extensions that implement file uploads without custom TypeConverters, as they inherit the vulnerable file handling behavior. The vulnerability can result in unauthorized read access and potential file system compromise (GitHub Advisory).

This vulnerability is particularly concerning as it requires no authentication to exploit. The attack vector is network-accessible, and the complexity of exploitation is considered low. The vulnerability has received a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L, indicating its high exploitability (NIST NVD).

The vulnerability was patched in TYPO3 versions 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The fix includes several changes: the UploadedFileReferenceConverter is now restricted to the Form Framework scope, the storage location has been changed to /fileadmin/form_uploads/, and allowed mime-types must match expected file extensions. Extensions relying on the global UploadedFileReferenceConverter must implement a custom TypeConverter or explicitly implement the ext:form UploadedFileReferenceConverter with appropriate mime-type settings (TYPO3 Advisory).