CVE-2021-43563 : Security Advisory and Response

An issue was discovered in the pixxio extension before 1.0.6 for TYPO3, allowing unauthenticated attackers to access and download media files from the DAM system.

Understanding CVE-2021-43563

What is CVE-2021-43563?

An issue in the pixxio extension for TYPO3 grants unauthenticated attackers access to the pixx.io API for the configured API user, enabling download of media files from the DAM system.

The Impact of CVE-2021-43563

The vulnerability allows unauthorized individuals to download various media files from the DAM system, potentially compromising sensitive data.

Technical Details of CVE-2021-43563

Vulnerability Description

The Access Control in the bundled media browser of the pixxio extension is faulty, enabling unauthenticated attackers to interact with the pixx.io API.

Affected Systems and Versions

Product: pixxio extension
Vendor: Typo3
Versions affected: <1.0.6

Exploitation Mechanism

Attackers exploit the broken Access Control in the media browser to perform requests to the pixx.io API and download media files.

Mitigation and Prevention

Immediate Steps to Take

Update the pixxio extension to version 1.0.6 or higher.
Implement strong authentication mechanisms to restrict unauthorized access.

Long-Term Security Practices

Regularly monitor and audit access to sensitive data.
Conduct security assessments to identify and address similar vulnerabilities.

Patching and Updates

Apply security patches promptly to prevent exploitation of known vulnerabilities.