CVE-2024-34537

Vulnerability

Overview

The vulnerability resides in the Bookmark Toolbar component (ext:backend) of TYPO3 CMS. Due to insufficient input validation, an attacker with an administrator-level backend user account can manipulate data saved in the bookmark toolbar. This manipulated data causes a general error state that blocks further access to the backend interface for all users [1][2][4].

Exploitation and

Attack Surface

Exploitation requires a backend user account with administrator privileges. The vulnerability is triggered by sending a crafted JSON object via the bookmark creation request, which is not properly validated before being stored in the database [2]. Once the manipulated data is saved, any attempt to access the backend interface results in an unhandled error, effectively locking out all administrators [4].

Impact

A successful attack results in a complete denial of service of the TYPO3 backend administration interface. The only way to recover is by manually removing the malformed bookmark entry directly from the database [2]. This can cause significant operational downtime, especially in environments with multiple administrators relying on the backend for content management.

Mitigation

The issue has been fixed in TYPO3 versions 10.4.46 ELTS, 11.5.40 LTS, 12.4.21 LTS, and 13.3.1 [1][4]. Administrators are strongly advised to update their installations to one of these patched versions as soon as possible. No workaround is provided other than the update.