CVE-2024-38873: FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass
Summary
CVE-2024-38873: FriendlyCaptcha Plugin for TYPO3 Captcha Check Bypass. Affects studiomitte/friendlycaptcha versions < 0.1.4. Fixed in 0.1.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The friendlycaptcha_official extension is a plugin for TYPO3 that integrates the Friendly Captcha service into the ext:form extension. This plugin provides a captcha field to protect forms from automated submissions. It is designed to ensure that form submissions are made by human users rather than bots.
Vulnerability Detail
The friendlycaptcha_official extension before version 0.1.4 fails to properly check the requirement of the captcha field in submitted form data. This allows a remote user to bypass the captcha check and submit the form without solving the captcha challenge. As a result, the intended protection against automated submissions is rendered ineffective. This vulnerability only affects the captcha integration for the ext:form extension in TYPO3.
How To Fix
Minimum fixed version
0.1.4
This is the first release that contains the fix.
composer require studiomitte/friendlycaptcha:0.1.4Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to update the friendlycaptcha_official extension to the latest version as soon as possible.
Conclusion
The friendlycaptcha_official extension for TYPO3 is vulnerable to a captcha check bypass, allowing remote users to submit forms without solving the captcha challenge. To mitigate this vulnerability, it is recommended to update the extension to version 0.1.4 or later. For further support and assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for studiomitte/friendlycaptcha →
FAQ
This vulnerability allows remote users to bypass the captcha check in the friendlycaptcha_official extension for TYPO3. As a result, automated submissions can be made without solving the captcha challenge, potentially leading to an increased risk of spam or malicious activity.
Versions of the friendlycaptcha_official extension before 0.1.4 are affected by this vulnerability.
Yes, the fix for this vulnerability is included in version 0.1.4 of the friendlycaptcha_official extension. Users should update to this version or later to mitigate the risk.
Users can update the friendlycaptcha_official extension by following the standard TYPO3 extension update process. This typically involves accessing the TYPO3 backend, navigating to the extension manager, and selecting the option to update the extension.
Yes, you can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file to provide accurate vulnerability information.
