CVE-2024-38874: events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability
Summary
CVE-2024-38874: events2 TYPO3 extension insecure direct object reference (IDOR) vulnerability. Affects jweiland/events2 across 2 version ranges.
< 8.3.8
>= 9.0.0, < 9.0.6
Fixed in 8.3.8 or 9.0.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The events2 (aka Events 2) extension is a TYPO3 extension that provides functionality for managing events. It allows users to create, update, and delete events, as well as view event details and RSVP. The extension is widely used in TYPO3 websites to handle event management and registration.
Vulnerability Detail
The events2 extension before version 8.3.8 and 9.x before 9.0.6 for TYPO3 is vulnerable to an insecure direct object reference (IDOR) vulnerability. This vulnerability arises due to missing access checks in the management plugin. As a result, unauthenticated users can potentially activate or delete various events without proper authorization. This can lead to unauthorized modifications or removal of events, causing disruption to event management and registration processes.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.3.88.3.8composer require jweiland/events2:8.3.8 -
>= 9.0.0, < 9.0.69.0.6composer require jweiland/events2:9.0.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update the events2 extension to the fixed versions as mentioned above.
Conclusion
The events2 TYPO3 extension is vulnerable to an insecure direct object reference (IDOR) vulnerability, which allows unauthenticated users to activate or delete events without proper authorization. To mitigate this vulnerability, it is crucial to update the extension to the fixed versions (8.3.8 for TYPO3 8.x and 9.0.6 for TYPO3 9.x). For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for jweiland/events2 →
FAQ
An insecure direct object reference (IDOR) vulnerability occurs when an application allows direct access to internal objects or resources without proper authorization. In the case of the events2 extension, this vulnerability enables unauthenticated users to manipulate events without the necessary permissions.
The IDOR vulnerability in the events2 extension can lead to unauthorized activation or deletion of events by unauthenticated users. This can disrupt event management and registration processes, potentially causing confusion, loss of data, or unauthorized modifications to event details.
You can use Vulert's playground at Vulert Scanner to check if your TYPO3 installation is affected by this vulnerability. Vulert analyzes the composer.lock file to identify and alert for open-source vulnerabilities in software, including TYPO3 extensions.
Yes, the events2 extension has released fixed versions (8.3.8 for TYPO3 8.x and 9.0.6 for TYPO3 9.x) that address this vulnerability. It is recommended to update the extension to the latest fixed version to mitigate the risk of IDOR attacks.
You can find more information about this vulnerability, including the technical details and affected versions, in the advisory on GitHub: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/06/GHSA-cchp-3rq6-69wj/GHSA-cchp-3rq6-69wj.json
