GHSA-g585-crjf-vhwq: 
PHP vulnerability analysis and mitigation

TYPO3's built-in record registration functionality (aka "basic shopping cart") was identified with a high-severity denial of service vulnerability, tracked as GHSA-g585-crjf-vhwq. The vulnerability affects TYPO3 CMS versions 7.0.0 to 7.6.31 and 8.0.0 to 8.7.20, with the issue being discovered and patched on December 11, 2018. The vulnerability was addressed in versions 7.6.32 and 8.7.21 (TYPO3 Advisory).

The vulnerability stems from improper validation of anonymous user sessions in the frontend record registration functionality that uses the 'recs' URL parameters. The issue received a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-770 (GitHub Advisory).

The vulnerability allows attackers to create an arbitrary amount of individual session-data records in the database, potentially leading to database flooding and system resource exhaustion. This could result in a denial of service condition affecting the availability of the TYPO3 installation (TYPO3 Advisory).

The vulnerability can be exploited remotely without requiring any privileges or user interaction. The attack complexity is considered low, making it relatively straightforward to exploit (GitHub Advisory).

The vulnerability was addressed by introducing a new configuration option $TYPO3_CONF_VARS[FE][enableRecordRegistration] that is disabled by default for security. Organizations that require this functionality must explicitly enable it through the Install Tool or deployment techniques. The feature was deprecated in TYPO3 v8.6.0 and completely removed in TYPO3 v9.0.0, making version 9 unaffected by this vulnerability (TYPO3 Advisory).