GHSA-hh95-5xm5-v8v7: 
PHP vulnerability analysis and mitigation

A vulnerability in TYPO3 CMS's Extbase Request Handling component was discovered, identified as GHSA-hh95-5xm5-v8v7. The issue, disclosed on December 17, 2019, affects TYPO3 CMS versions 8.0.0 to 8.7.30 and 9.0.0 to 9.5.12. This security flaw involves potential insecure deserialization in the request handling process (TYPO3 Advisory).

The vulnerability stems from the way Extbase handles request deserialization. While user-submitted payloads require signing with HMAC-SHA1 using the TYPO3 encryptionKey as a secret, and invalid or unsigned payloads are not deserialized, the security mechanism can be bypassed if the encryptionKey is compromised. The issue has a CVSS v3.1 score of 8.1 (High), with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

If successfully exploited, this vulnerability could lead to unauthorized access with high impact on confidentiality, integrity, and availability of the system. The attack requires network access and high complexity but needs no privileges or user interaction (GitHub Advisory).

Exploitation requires two specific conditions: 1) At least one Extbase plugin must be rendered in the frontend, and 2) The encryptionKey must have been leaked from LocalConfiguration.php or corresponding .env file. The encryptionKey could be exposed through accidental repository commits or unprotected backup files (TYPO3 Advisory).

The vulnerability was patched in TYPO3 versions 8.7.30 and 9.5.12. However, due to negative side-effects, the hardening had to be reverted in TYPO3 version 10.4.0 and 9.5.16. For TYPO3 v10, the solution involves using json_decode instead of unserialize, though this was not feasible in existing LTS branches due to potential backward compatibility issues (TYPO3 Advisory).