CVE-2021-43562
📋 TL;DR
This vulnerability in the pixxio TYPO3 extension allows Server-Side Request Forgery (SSRF) that can lead to remote code execution. Attackers with TYPO3 backend access can download arbitrary files from remote servers to user-controlled filenames. Only TYPO3 installations with the vulnerable pixxio extension are affected.
💻 Affected Systems
- TYPO3 pixxio extension (pixx.io integration/DAM)
📦 What is this software?
Pixx.io by Pixxio
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data exfiltration, or ransomware deployment.
Likely Case
Unauthorized file downloads, internal network reconnaissance, and potential lateral movement within the TYPO3 environment.
If Mitigated
Limited to file downloads from external sources without code execution if proper file validation is in place.
🎯 Exploit Status
Exploitation requires TYPO3 backend credentials but the SSRF to RCE chain is straightforward once authenticated.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.6
Vendor Advisory: https://typo3.org/security/advisory/typo3-ext-sa-2021-017
Restart Required: No
Instructions:
1. Update the pixxio extension to version 1.0.6 or later via TYPO3 Extension Manager. 2. Clear TYPO3 caches. 3. Verify the extension version in the Extension Manager.
🔧 Temporary Workarounds
Disable pixxio extension
allTemporarily disable the vulnerable extension until patching is possible
typo3cms extension:deactivate pixxio
Restrict backend access
allLimit TYPO3 backend access to trusted users only
🧯 If You Can't Patch
- Implement network segmentation to restrict outbound connections from TYPO3 server
- Apply strict file upload validation and disable dangerous file extensions
🔍 How to Verify
Check if Vulnerable:
Check TYPO3 Extension Manager for pixxio extension version. If version is below 1.0.6, system is vulnerable.Check Version:
typo3cms extension:list | grep pixxioVerify Fix Applied:
Confirm pixxio extension version is 1.0.6 or higher in TYPO3 Extension Manager.📡 Detection & Monitoring
Log Indicators:
- Unusual file downloads via pixxio endpoints
- External HTTP requests from TYPO3 to unexpected domains
- File write operations with suspicious filenames
Network Indicators:
- Outbound HTTP requests from TYPO3 server to non-pixx.io domains
- Unusual file download patterns from external sources
SIEM Query:
source="typo3.log" AND ("pixxio" OR "pixx.io") AND ("download" OR "external" OR "remote")