CVE-2024-34358: TYPO3 CMS RCE Vulnerability

CVE-2024-34358 Overview

CVE-2024-34358 is a resource consumption vulnerability in TYPO3, an enterprise content management system. The flaw resides in the ShowImageController (eID tx_cms_showpic), which lacks a cryptographic HMAC signature on the frame HTTP query parameter. Unauthenticated remote attackers can instruct the server to generate an arbitrary number of thumbnail images, leading to uncontrolled resource consumption [CWE-770] and information exposure [CWE-200]. The issue affects TYPO3 versions 9.0.0 through the fixed releases 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, and 13.1.1.

Critical Impact
Unauthenticated attackers can trigger unbounded server-side image generation, exhausting CPU, memory, and disk resources on TYPO3 frontends.

Affected Products

TYPO3 versions 9.0.0 up to 9.5.48 ELTS
TYPO3 versions 10.0.0 up to 10.4.45 ELTS and 11.0.0 up to 11.5.37 LTS
TYPO3 versions 12.0.0 up to 12.4.15 LTS and 13.0.0 up to 13.1.1

Discovery Timeline

2024-05-14 - CVE-2024-34358 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34358

Vulnerability Analysis

The TYPO3 ShowImageController handles image display requests routed through the eID entry point tx_cms_showpic. The controller signs most parameters (such as file and dimensions) with an HMAC token to prevent tampering. The frame query parameter, however, is not included in the signature calculation. An attacker who obtains any valid signed image URL can append or modify the frame parameter with arbitrary values and force the server to generate a new thumbnail for each variation.

Each request triggers a full image processing operation on the backend, consuming CPU, memory, and disk storage. Because the endpoint requires no authentication and the frame value has no upper bound, adversaries can trivially script large numbers of requests to exhaust server resources or fill the filesystem with generated thumbnails.

Root Cause

The root cause is a missing integrity check on a user-controlled input. The frame parameter was intended for internal core APIs but was accepted from user requests without validation. Because it was excluded from the HMAC token, attackers could freely mutate it while reusing an otherwise valid signed URL, bypassing the signing mechanism's intent.

Attack Vector

Exploitation requires only network access to a TYPO3 frontend that exposes the tx_cms_showpic eID handler. An attacker crafts requests of the form /index.php?eID=tx_cms_showpic&file=<signed>&...&frame=<N>, iterating N across a large range. Each request produces a fresh thumbnail on disk, resulting in a denial-of-service condition through resource exhaustion.

php

// Patch: typo3/sysext/core/Configuration/DefaultConfiguration.php
'security.frontend.htmlSanitizeParseFuncDefault' => true,
'security.frontend.enforceLoginSigning' => true,
'security.frontend.allowInsecureSiteResolutionByQueryParameters' => false,
'security.frontend.allowInsecureFrameOptionInShowImageController' => false,
'security.backend.htmlSanitizeRte' => false,
'security.backend.enforceReferrer' => true,

Source: TYPO3 commit 05c95fed. The patch introduces a new feature flag that, by default, causes the frame parameter to be ignored during image rendering.

Detection Methods for CVE-2024-34358

Indicators of Compromise

Repeated HTTP requests to /index.php?eID=tx_cms_showpic with varying frame query parameter values from a single source IP or small IP set
Unexpected growth in the TYPO3 typo3temp/assets/_processed_/ directory or configured image processing cache paths
Sustained spikes in ImageMagick, GraphicsMagick, or PHP-FPM CPU and memory usage on TYPO3 frontends

Detection Strategies

Alert on high request rates to the tx_cms_showpic eID from individual clients, particularly when the frame parameter cycles through many distinct integer values
Correlate web server access logs with image processor process counts to identify sustained thumbnail generation activity
Track the size and file count of TYPO3 processed image storage locations and alert on abnormal growth

Monitoring Recommendations

Enable verbose logging on the TYPO3 frontend and forward web server logs to a centralized analytics platform for query and correlation
Monitor filesystem inode consumption on volumes storing processed images to catch exhaustion before it impacts service
Baseline normal tx_cms_showpic request volume and alert on statistically significant deviations

How to Mitigate CVE-2024-34358

Immediate Actions Required

Upgrade TYPO3 to a fixed release: 9.5.48 ELTS, 10.4.45 ELTS, 11.5.37 LTS, 12.4.15 LTS, or 13.1.1
Do not enable the security.frontend.allowInsecureFrameOptionInShowImageController feature flag unless a legacy dependency strictly requires it
Rate limit requests to the eID=tx_cms_showpic endpoint at the web server or WAF layer

Patch Information

The fix is delivered by the commits 05c95fed, 1e70ebf7, and df7909b6. See the TYPO3 Security Advisory GHSA-36g8-62qv-5957 and TYPO3-CORE-SA-2024-010. After patching, the frame query parameter is ignored by default because it was not required by core APIs.

Workarounds

Deploy WAF rules that strip or reject the frame query parameter on requests to eID=tx_cms_showpic
Apply per-IP rate limits and connection caps at the reverse proxy for the TYPO3 frontend
Quota-restrict the filesystem partition hosting typo3temp/assets/_processed_/ to contain damage if abuse occurs

bash

# Configuration example: keep the secure default after upgrade
# In LocalConfiguration.php / AdditionalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.frontend.allowInsecureFrameOptionInShowImageController'] = false;