Project

General

Profile

Actions

Bug #98264

open

Logging "unsupported" HTTP request methods as an exception into the log is wrong

Added by Stefan P over 1 year ago. Updated 9 months ago.

Status:
Under Review
Priority:
Should have
Assignee:
-
Category:
-
Target version:
-
Start date:
2022-09-06
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
12
PHP Version:
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

The class TYPO3\CMS\Core\Http\Request will log any "unsupported" HTTP method as an Exception to the logs. \InvalidArgumentException('Unsupported HTTP method "' . $method . '".', 1436717275);

Knowing this one can exploit any modern TYPO3 setup by simply doing curl -XUNKWNONMETHOD https://target-host in a "slow" loop (slow enough to not be considered a DoS) and spam everyones sys_log.

The correct way of handling an unsupported method is by answering with 501 (Not Implemented).

Discovered in v10, but still valid in current master.


Related issues 1 (1 open0 closed)

Related to TYPO3 Core - Bug #103129: Modified "Host" header with invalid port leads to exception when creating the ServerRequestFactory->fromGlobalsUnder ReviewStefan Bürk2024-02-15

Actions
Actions

Also available in: Atom PDF