CVE-2021-41113: Typo3/cms core Cross-Site-Request-Forgery Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-657m-v5vm-f6rw",
  "modified" : "2024-02-05T11:18:00Z",
  "published" : "2021-10-05T20:23:47Z",
  "aliases" : [ "CVE-2021-41113" ],
  "summary" : "Cross-Site-Request-Forgery in Backend",
  "details" : "> ### Meta\n> * CVSS: `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C` (8.2)\n\n### Problem\nIt has been discovered that the new TYPO3 v11 feature that allows users to create and share [deep links in the backend user interface](https://typo3.org/article/typo3-version-112-escape-the-orbit#c12178) is vulnerable to cross-site-request-forgery.\n\nThe impact is the same as described in [TYPO3-CORE-SA-2020-006 (CVE-2020-11069)](https://typo3.org/security/advisory/typo3-core-sa-2020-006). However, it is not limited to the same site context and does not require the attacker to be authenticated. In a worst case scenario, the attacker could create a new admin user account to compromise the system.\n\nTo successfully carry out an attack, an attacker must trick his victim to access a compromised system. The victim must have an active session in the TYPO3 backend at that time.\n\nThe following [Same-Site cookie settings](https://docs.typo3.org/c/typo3/cms-core/master/en-us/Changelog/8.7.x/Feature-90351-ConfigureTYPO3-shippedCookiesWithSameSiteFlag.html) in _$GLOBALS[TYPO3_CONF_VARS][BE][cookieSameSite]_ are required for an attack to be successful:\n\n* _SameSite=_***strict***: malicious evil.**example.org** invoking TYPO3 application at good.**example.org**\n* _SameSite=_***lax*** or ***none***: malicious **evil.com** invoking TYPO3 application at **example.org**\n\n### Solution\nUpdate your instance to TYPO3 version 11.5.0 which addresses the problem described.\n\n### Credits\nThanks to Richie Lee who reported this issue and to TYPO3 core & security team members Benni Mack and Oliver Hader who fixed the issue.\n\n### References\n* [TYPO3-CORE-SA-2021-014](https://typo3.org/security/advisory/typo3-core-sa-2021-014)\n* [CVE-2020-11069](https://nvd.nist.gov/vuln/detail/CVE-2020-11069) reintroduced in TYPO3 v11.2.0",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "typo3/cms-core"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.2.0"
      }, {
        "fixed" : "11.5.0"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "typo3/cms"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.2.0"
      }, {
        "fixed" : "11.5.0"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/TYPO3/typo3/security/advisories/GHSA-657m-v5vm-f6rw"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2020-11069"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-41113"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/TYPO3/typo3/commit/fa51999203c5e5d913ecae5ea843ccb2b95fa33f"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms-core/CVE-2021-41113.yaml"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/FriendsOfPHP/security-advisories/blob/master/typo3/cms/CVE-2021-41113.yaml"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/TYPO3/typo3"
  }, {
    "type" : "WEB",
    "url" : "https://typo3.org/security/advisory/typo3-core-sa-2020-006"
  }, {
    "type" : "WEB",
    "url" : "https://typo3.org/security/advisory/typo3-core-sa-2021-014"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-309", "CWE-352" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-10-05T18:48:07Z",
    "nvd_published_at" : "2021-10-05T18:15:00Z"
  }
}