Denial of Service in Page Error Handling

CVE-2021-21359 is a denial-of-service (DoS) vulnerability in TYPO3, an open-source PHP-based CMS. The root cause lies in the error handler for invalid or non-existing resources. When a request triggers the page error handler, it can retrieve content from another page to display as the error message. This design allows the application to recursively call itself, amplifying each request until web server limits are exceeded [2].

Exploitation

An attacker can exploit this vulnerability by sending HTTP requests for invalid or non-existing resources. No authentication is required, as the attack targets the unauthenticated error-handling path. Each recursive cycle increases the load on the server, eventually consuming all resources [2].

Impact

Successful exploitation leads to resource exhaustion of the web server, causing a denial of service. The impact is limited to availability; data integrity or confidentiality are not directly affected. The vulnerability can be triggered remotely via simple HTTP requests [2].

Mitigation

The issue is fixed in TYPO3 versions 9.5.25, 10.4.14, and 11.1.1 [2]. Users should upgrade immediately. No workarounds are documented, but restricting access to the error handler via web server configuration may reduce exposure. It is not listed in CISA's Known Exploited Vulnerabilities catalog as of this writing.