CVE-2022-44543: TYPO3 Extension femanager Broken Access Control
Summary
CVE-2022-44543: TYPO3 Extension femanager vulnerable to Broken Access Control. Affects in2code/femanager across 3 version ranges.
< 5.5.2
>= 6.0.0, < 6.3.3
>= 7.0.0, < 7.0.1
Fixed in 5.5.2, 6.3.3 or 7.0.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The TYPO3 Extension femanager is a popular package used for managing frontend users in TYPO3 websites. It provides features for user registration, login, and profile management. The extension allows administrators to define user groups with specific permissions and restrictions. However, prior to versions 5.5.2, 6.3.3, and 7.0.1, femanager is vulnerable to a broken access control issue.
Vulnerability Detail
The broken access control vulnerability in femanager arises from a bypass of the usergroup.inList validation. This validation is intended to ensure that new frontend users created by the extension are only assigned to allowed user groups. However, due to a flaw, this validation can be bypassed, allowing new users to be members of restricted groups. Exploiting this vulnerability requires the presence of the 'usergroup' field in the registration form. Versions 5.5.2, 6.3.3, and 7.0.1 of femanager have been patched to address this issue.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 5.5.25.5.2composer require in2code/femanager:5.5.2 -
>= 6.0.0, < 6.3.36.3.3composer require in2code/femanager:6.3.3 -
>= 7.0.0, < 7.0.17.0.1composer require in2code/femanager:7.0.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating the femanager extension is not immediately feasible, a temporary workaround can be implemented by removing the 'usergroup' field from the registration form. This can be achieved by modifying the form configuration in the TYPO3 backend. However, it is important to note that this workaround only mitigates the vulnerability and does not provide a permanent solution. Updating to the patched versions is still recommended.
Conclusion
The TYPO3 Extension femanager prior to versions 5.5.2, 6.3.3, and 7.0.1 is vulnerable to a broken access control issue. This vulnerability allows new frontend users to be assigned to restricted user groups, potentially compromising the security of the TYPO3 website. It is recommended to update the femanager extension to the patched versions or apply the temporary workaround of removing the 'usergroup' field from the registration form. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for in2code/femanager →
FAQ
The vulnerability allows new frontend users to be assigned to restricted user groups, potentially granting them unauthorized access to certain resources or functionalities. This can lead to privilege escalation and compromise the security of the TYPO3 website.
No, this vulnerability only affects TYPO3 websites that have the femanager extension installed and utilize the 'usergroup' field in the registration form.
No, the vulnerability requires an attacker to have access to the registration form and be able to submit a registration request with a manipulated 'usergroup' value.
There are no known instances of this vulnerability being exploited in the wild. However, it is still important to apply the necessary patches to prevent any potential exploitation.
More information about the patched versions can be found in the release notes or changelog of the femanager extension on the TYPO3 extension repository.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/femanager.
