CVE-2021-36789
📋 TL;DR
This vulnerability allows SQL injection in the dated_news extension for TYPO3, enabling attackers to execute arbitrary SQL commands on the database. It affects TYPO3 installations using the dated_news extension version 5.1.1 and earlier. Attackers could potentially read, modify, or delete database content.
💻 Affected Systems
- TYPO3 dated_news extension
📦 What is this software?
Dated News by Dated News Project
⚠️ Risk & Real-World Impact
Worst Case
Complete database compromise leading to data theft, data destruction, or full system takeover via subsequent attacks.
Likely Case
Unauthorized data access, data manipulation, or privilege escalation through SQL injection.
If Mitigated
Limited impact with proper input validation and database permissions in place.
🎯 Exploit Status
SQL injection vulnerabilities are commonly exploited and tooling exists for automated exploitation.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version 5.1.2 or later
Vendor Advisory: https://typo3.org/security/advisory/typo3-ext-sa-2021-013
Restart Required: No
Instructions:
1. Update dated_news extension to version 5.1.2 or later via TYPO3 Extension Manager. 2. Clear TYPO3 caches. 3. Verify the update was successful.
🔧 Temporary Workarounds
Disable dated_news extension
allTemporarily disable the vulnerable extension until patching is possible
typo3cms extension:deactivate dated_news
Implement WAF rules
allAdd SQL injection detection rules to web application firewall
🧯 If You Can't Patch
- Restrict network access to affected TYPO3 instances
- Implement strict database user permissions with minimal privileges
🔍 How to Verify
Check if Vulnerable:
Check TYPO3 Extension Manager for dated_news extension version. If version is 5.1.1 or earlier, system is vulnerable.Check Version:
typo3cms extension:list | grep dated_newsVerify Fix Applied:
Confirm dated_news extension version is 5.1.2 or later in TYPO3 Extension Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual SQL queries in database logs
- Multiple failed login attempts
- Unexpected database errors
Network Indicators:
- SQL injection patterns in HTTP requests
- Unusual database connection patterns
SIEM Query:
source="web_logs" AND ("dated_news" OR "sql" OR "union" OR "select" OR "insert")