CVE-2024-34358: 
PHP vulnerability analysis and mitigation

TYPO3, an enterprise content management system, disclosed a vulnerability (CVE-2024-34358) affecting versions 9.0.0 through 13.1.0 (prior to versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1). The vulnerability was discovered in the ShowImageController component, specifically in the handling of the frame HTTP query parameter in the tx_cms_showpic eID script (TYPO3 Advisory).

The vulnerability stems from the ShowImageController's lack of a cryptographic HMAC-signature validation for the frame HTTP query parameter (e.g., /index.php?eID=tx_cms_showpic?file=3&...&frame=12345). The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L (GitHub Advisory).

The vulnerability allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side, potentially leading to uncontrolled resource consumption and denial of service conditions (TYPO3 Advisory).

The vulnerability is exploitable remotely without requiring authentication or user interaction. An attacker can craft specific HTTP requests targeting the frame parameter to trigger resource consumption (GitHub Advisory).

The issue has been fixed in TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1. In the patched versions, the frame HTTP query parameter is ignored by default. A new feature flag 'security.frontend.allowInsecureFrameOptionInShowImageController' has been introduced, which is disabled by default but can be enabled to reactivate the previous behavior if necessary (TYPO3 Advisory).

The vulnerability was reported by TYPO3 security team member Torben Hansen and fixed by TYPO3 core & security team members Benjamin Mack and Benjamin Franzke (TYPO3 Advisory).