typo3 typo3 输入验证不恰当

CVE编号

CVE-2021-41114

利用情况

暂无

补丁情况

N/A

披露时间

2021-10-06

漏洞描述

TYPO3 is an open source PHP based web content management system released under the GNU GPL. It has been discovered that TYPO3 CMS is susceptible to host spoofing due to improper validation of the HTTP Host header. TYPO3 uses the HTTP Host header, for example, to generate absolute URLs during the frontend rendering process. Since the host header itself is provided by the client, it can be forged to any value, even in a name-based virtual hosts environment. This vulnerability is the same as described in TYPO3-CORE-SA-2014-001 (CVE-2014-3941). A regression, introduced during TYPO3 v11 development, led to this situation. The already existing setting $GLOBALS['TYPO3_CONF_VARS']['SYS']['trustedHostsPattern'] (used as an effective mitigation strategy in previous TYPO3 versions) was not evaluated anymore, and reintroduced the vulnerability.

解决建议

建议您更新当前系统或软件至最新版，完成漏洞的修复。

参考链接
https://github.com/TYPO3/typo3/commit/5cbff85506cebe343e5ae59228977547cf8e3cf4
https://github.com/TYPO3/typo3/security/advisories/GHSA-m2jh-fxw4-gphm
https://typo3.org/security/advisory/typo3-core-sa-2021-015

受影响软件情况

#	类型	厂商	产品	版本	影响面
1
	运行在以下环境
	应用	typo3	typo3	*	From (including) 11.0.0	Up to (excluding) 11.5.0

CVSS3评分 4.8

• 攻击路径 网络
• 攻击复杂度 高
• 权限要求 无
• 影响范围 未更改
• 用户交互 无
• 可用性 低
• 保密性 无
• 完整性 低

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L CWE-ID 漏洞类型 CWE-20 输入验证不恰当 CWE-644 对HTTP头部进行脚本语法转义处理不恰当