CVE-2021-21359: 
PHP vulnerability analysis and mitigation

TYPO3, an open source PHP based web content management system, was found to be vulnerable to a denial of service attack (CVE-2021-21359). The vulnerability was discovered in March 2021 and affected TYPO3 versions 9.0.0-9.5.24, 10.0.0-10.4.13, and 11.0.0-11.1.0. The issue was fixed in versions 9.5.25, 10.4.14, and 11.1.1 (TYPO3 Advisory, GitHub Advisory).

The vulnerability occurs in the Page Error Handling component of TYPO3. When invalid or non-existing resources are requested via HTTP, the page error handler attempts to retrieve content to be shown as an error message from another page. This creates a recursive calling scenario where the application calls itself repeatedly, leading to resource exhaustion. The vulnerability has been assigned a CVSS v3.1 base score of 5.9 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H. The issue is classified under CWE-674 (Uncontrolled Recursion) and CWE-405 (Asymmetric Resource Consumption) (GitHub Advisory).

The vulnerability can lead to a denial of service condition where the web server's resources are exhausted due to the recursive calls. This can result in the server becoming unresponsive and unavailable to legitimate users (TYPO3 Advisory).

The vulnerability can be exploited by an unauthenticated attacker with network access by sending HTTP requests for invalid or non-existing resources. While the attack requires no special privileges, it does require specific conditions to be met for successful exploitation (GitHub Advisory).

The recommended mitigation is to update to the patched versions: TYPO3 9.5.25, 10.4.14, or 11.1.1. These versions contain the necessary fixes to prevent the recursive calling behavior in the page error handler (TYPO3 Advisory).

The vulnerability was responsibly disclosed and fixed with the help of multiple community members. Paul Keller, Mathias Bolt Lesniak, and Kay Strobach reported the issue, while TYPO3 framework merger Frank Nägler and security team member Torben Hansen implemented the fix (TYPO3 Advisory).