OpenID Connect Authentication Bypass in Typo3 extension
Summary
CVE-2024-30173: OpenID Connect Authentication (oidc) Typo3 extension Authentication Bypass. Affects causal/oidc versions < 2.1.0. Fixed in 2.1.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The OpenID Connect Authentication (oidc) extension is a component of Typo3, a popular content management system. The extension provides authentication services for frontend users using the OpenID Connect protocol. It allows users to log in to their accounts using their OpenID Connect credentials.
Vulnerability Detail
The authentication service of the oidc extension does not properly verify the OpenID Connect authentication state during the user lookup process. Instead, it authenticates any valid frontend user whose 'ctx_oidc' field is not empty. This means that in scenarios where either the ext:felogin extension is active or the 'checkFeUserPid' configuration option is disabled, an attacker can log in to OpenID Connect frontend user accounts by providing a valid username and any password. This bypasses the intended authentication process and grants unauthorized access to user accounts.
How To Fix
Minimum fixed version
2.1.0
This is the first release that contains the fix.
composer require causal/oidc:2.1.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the oidc extension is not immediately possible, a temporary workaround is to ensure that the ext:felogin extension is not active and the 'checkFeUserPid' configuration option is enabled. This will prevent the authentication bypass vulnerability from being exploited.
Conclusion
The OpenID Connect Authentication Bypass vulnerability in the oidc extension of Typo3 allows attackers to bypass the authentication process and gain unauthorized access to user accounts. It is crucial to update the extension to version 2.1.0 or later to mitigate this vulnerability. If immediate updating is not possible, disabling the ext:felogin extension and enabling the 'checkFeUserPid' configuration option can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for causal/oidc →
FAQ
This vulnerability allows attackers to bypass the OpenID Connect authentication process and gain unauthorized access to user accounts in Typo3.
Yes, this vulnerability can be exploited remotely if the affected Typo3 instance is accessible over the internet.
The recommended mitigation is to update the oidc extension to version 2.1.0 or later. Alternatively, ensuring that the ext:felogin extension is not active and the 'checkFeUserPid' configuration option is enabled can also mitigate the vulnerability.
Yes, the CVSS score for this vulnerability is 6.0, indicating a moderate severity level.
For more information about this vulnerability, you can visit the Vulert Playground at Vulert Scanner. The playground allows you to check if your application is affected by this vulnerability without any signup or code installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for causal/oidc.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
