CVE-2009-1264: Frontend User Registration Extension for TYPO3 Vulnerability - Inadequate Access Rights Verification
Summary
CVE-2009-1264: Frontend User Registration extension for TYPO3 does not properly verify access rights. Affects sjbr/sr-feuser-register versions < 2.5.21. Fixed in 2.5.21. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Frontend User Registration (sr_feuser_register) extension is a TYPO3 package that facilitates user registration on TYPO3-based websites. It allows frontend users to register, manage their profiles, and handle authentication. However, versions 2.5.20 and earlier of this extension are vulnerable due to improper access rights verification, which can lead to unauthorized access to sensitive user information.
Vulnerability Detail
The vulnerability arises from the Frontend User Registration extension's failure to properly verify access rights for authenticated users. This oversight allows remote authenticated users to exploit the system and potentially access sensitive information, including passwords, through unknown attack vectors. The lack of adequate access control measures poses a significant risk, as it can lead to data breaches and unauthorized access to user accounts.
How To Fix
Minimum fixed version
2.5.21
This is the first release that contains the fix.
composer require sjbr/sr-feuser-register:2.5.21Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the registration functionality by implementing additional access controls within your TYPO3 configuration. This may involve modifying user permissions or disabling the registration feature until the extension is updated.
Conclusion
The Frontend User Registration extension for TYPO3 has a critical vulnerability due to improper access rights verification, allowing unauthorized access to sensitive information. It is crucial to update to the patched version 2.5.21 to mitigate this risk. Additionally, users can utilize Vulert to monitor their applications for vulnerabilities in real-time.
See every vulnerability recorded for sjbr/sr-feuser-register →
FAQ
The vulnerability is related to inadequate access rights verification, allowing authenticated users to access sensitive information.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without any signup.
If exploited, this vulnerability can lead to unauthorized access to user accounts and sensitive information, including passwords.
Yes, the vulnerability has been patched in version 2.5.21 of the Frontend User Registration extension.
If immediate updates are not possible, consider implementing additional access controls or disabling the registration feature temporarily.
Related vulnerabilities
Recent vulnerabilities recorded for sjbr/sr-feuser-register.
