Unrestricted File Upload in Form Framework

Vulnerability

Description

CVE-2021-21355 is an unrestricted file upload vulnerability in TYPO3 CMS, affecting versions prior to 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The root cause is the lack of validation that file extensions correspond to configured allowed MIME types. Although the default fileDenyPattern blocks dangerous file extensions like .htaccess and .php, the UploadedFileReferenceConverter (from the ext:form extension) accepts files of any MIME type and persists them to the default location /fileadmin/user_upload/, retaining the original filename [2][3].

Exploitation

The vulnerability can be exploited remotely without authentication. An attacker can upload arbitrary files (e.g., HTML, SVG, or other executable content) by sending a crafted request to a TYPO3 instance that uses the Form Framework or any Extbase extension relying on the global UploadedFileReferenceConverter. The uploaded files are stored in a predictable location (/fileadmin/user_upload/) with the original filename, allowing direct access via URL [3][4].

Impact

Successful exploitation allows an attacker to upload malicious files that can be accessed directly, leading to information disclosure (e.g., guessing filenames of other users' uploads) or potential further attacks if the uploaded content is processed by the server. The CVSS score is 8.0 (High) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L [3][4].

Mitigation

The vulnerability is fixed in TYPO3 versions 8.7.40, 9.5.25, 10.4.14, and 11.1.1. The fix deregisters the UploadedFileReferenceConverter globally, restricts it to the Form Framework context, changes the storage location to a randomized path (/fileadmin/user_upload/form_/), and enforces MIME type to file extension matching [3][4].