GHSA-36g8-62qv-5957 TYPO3 vulnerable to an Uncontrolled Resource Consumption in the ShowImageController

• Packagist typo3/cms-core: >= 9.0.0, < 9.5.48 → fixed in 9.5.48 • Packagist typo3/cms-core: >= 10.0.0, < 10.4.45 → fixed in 10.4.45 • Packagist typo3/cms-core: >= 11.0.0, < 11.5.37 → fixed in 11.5.37 • Packagist typo3/cms-core: >= 12.0.0, < 12.4.15 → fixed in 12.4.15 • Packagist typo3/cms-core: >= 13.0.0, < 13.1.1 → fixed in 13.1.1

Problem The `ShowImageController` (_eID tx_cms_showpic_) lacks a cryptographic HMAC-signature on the `frame` HTTP query parameter (e.g. `/index.php?eID=tx_cms_showpic?file=3&...&frame=12345`). This allows adversaries to instruct the system to produce an arbitrary number of thumbnail images on the server side. Solution Update to TYPO3 versions 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, 13.1.1 that fix the problem described. ℹ️ Strong security defaults - Manual actions required The `frame` HTTP query parameter is now ignored, since it could not be used by core APIs. The new feature flag `security.frontend.allowInsecureFrameOptionInShowImageController` – which is disabled per default – can be used to reactivate the previous behavior. Credits Thanks to TYPO3 security team member Torben Hansen who reported this issue and to TYPO3 core & security team members Benjamin Mack and Benjamin Franzke who fixed the issue. References • TYPO3-CORE-SA-2024-010