GHSA-5h5v-m596-r6rf: 
PHP vulnerability analysis and mitigation

A vulnerability in TYPO3 CMS's Extbase Request Handling component was discovered and disclosed on December 17, 2019. The vulnerability affects TYPO3 CMS versions 8.x (>=8.0.0, <8.7.30) and 9.x (>=9.0.0, <9.5.12), potentially allowing insecure deserialization of user-submitted payloads (TYPO3 Advisory).

The vulnerability involves insecure deserialization in Extbase request handling. The exploitation requires user-submitted payloads to be signed with HMAC-SHA1 using the TYPO3 encryptionKey as secret. While invalid or unsigned payloads are not deserialized, if the encryptionKey is leaked through repositories or unprotected backup files, attackers could calculate the required HMAC-SHA1 to enable malicious payload deserialization. The vulnerability has been assigned a CVSS v3.1 score of 8.1 (High), with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

If successfully exploited, this vulnerability could lead to high impacts on system confidentiality, integrity, and availability. The vulnerability requires specific conditions to be exploited, including the presence of at least one Extbase plugin in the frontend and a leaked encryptionKey from LocalConfiguration.php or corresponding .env file (TYPO3 Advisory).

Exploitation of this vulnerability requires specific conditions: the target system must be rendering at least one Extbase plugin in the frontend, and the attacker must have access to the leaked encryptionKey. The attack complexity is considered high, requiring no user interaction or privileges, but network access is necessary (GitHub Advisory).

The vulnerability was initially patched in TYPO3 versions 8.7.30 and 9.5.12. However, due to negative side effects, the hardening measures were later reverted in TYPO3 versions 10.4.0 and 9.5.16. If an individual encryption-key has been leaked to the public, it should be treated as a critical incident (TYPO3 Advisory).