CVEs-PoC/2021/CVE-2021-21359.md

### [CVE-2021-21359](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-21359)
![](https://img.shields.io/static/v1?label=Product&message=TYPO3.CMS&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%2010.0.0%2C%20%3C%3D%2010.4.13%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%2011.0.0%2C%20%3C%3D%2011.1.0%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Version&message=%3E%3D%209.0.0%2C%20%3C%3D%209.5.24%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-405%20Asymmetric%20Resource%20Consumption%20(Amplification)&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-674%20Uncontrolled%20Recursion&color=brightgreen)

### Description

TYPO3 is an open source PHP based web content management system. In TYPO3 before versions 9.5.25, 10.4.14, 11.1.1 requesting invalid or non-existing resources via HTTP triggers the page error handler which again could retrieve content to be shown as error message from another page. This leads to a scenario in which the application is calling itself recursively - amplifying the impact of the initial attack until the limits of the web server are exceeded. This is fixed in versions 9.5.25, 10.4.14, 11.1.1.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/ARPSyndicate/cvemon