CVE-2021-36787

Vulnerability

The TYPO3 extension femanager for frontend user registration and management allows authenticated frontend users to upload SVG files as profile images. If the uploaded SVG is subsequently displayed on the website without sanitization, it can execute arbitrary JavaScript in the context of the victim's browser. The issue affects versions before 5.5.1 and versions 6.0.0 to 6.3.0 inclusive [1][4].

Exploitation

An attacker must be a logged-in frontend user with permission to upload a profile image. They craft a malicious SVG containing JavaScript payload and upload it through the normal profile image upload feature. When another user or administrator views a page that renders this SVG image (e.g., a user list or the attacker's profile), the payload executes in their browser. No further user interaction is required beyond navigating to the affected page [4].

Impact

Successful exploitation leads to stored cross-site scripting (XSS). The attacker can execute arbitrary JavaScript in the context of the victim's session, potentially leading to information disclosure (e.g., stealing session tokens or CSRF tokens), modifying page content, or performing actions on behalf of the victim. The scope of impact is limited by the permissions of the victim user [1][4].

Mitigation

The issue is fixed in versions 5.5.1 and 6.3.1, released on August 10, 2021. Users should update the femanager extension to at least these versions via the TYPO3 extension manager, Packagist, or the TYPO3 Extension Repository [3][4]. If SVG uploads are required, it is recommended to use the TYPO3 extension svg_sanitizer (added to TYPO3 core since versions 9.5.28, 10.4.18 and 11.3.0) or to set up a strict Content Security Policy for the destination folder of uploaded images [4].