The vulnerability allows authenticated users with file upload permissions to bypass a file extension check in the Form Framework. By uploading a form definition file with a mixed-case extension (e.g., .FORM.YAML instead of .form.yaml), an attacker can have the file processed by the system, leading to arbitrary SQL execution and potential privilege escalation.
The analysis of the provided patches pinpoints the exact functions responsible. The core of the vulnerability lies in TYPO3\CMS\Form\Slot\FilePersistenceSlot::isFormDefinition. This function's use of a case-sensitive check failed to identify malicious uploads with altered capitalization. The patch corrects this by converting the filename to lowercase before checking the extension.
A secondary but related function, TYPO3\CMS\Core\Resource\Driver\LocalDriver::sanitizeFileName, was also patched. This function is responsible for cleaning filenames. The fix introduces case normalization for filenames on case-insensitive filesystems. This change hardens the file handling process, preventing situations where the file system treats file.YAML and file.yaml as the same file, while the application logic might not.
During an exploit, an attacker would upload a file, triggering a call chain that includes sanitizeFileName to process the name and isFormDefinition to validate the file type. The failure in isFormDefinition is the direct cause of the bypass.
Miggo AI
