CVE-2024-47047: Insecure Direct Object Reference in powermail TYPO3 Extension
Summary
CVE-2024-47047: powermail TYPO3 extension has Insecure Direct Object Reference. Affects in2code/powermail across 4 version ranges.
< 7.5.1
>= 8.0.0, < 8.5.1
>= 9.0.0, < 10.9.1
>= 12.0.0, < 12.4.1
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The powermail extension for TYPO3 is a widely used tool that facilitates the creation and management of forms within TYPO3 websites. It allows users to easily handle user submissions and manage form data. However, the extension has been found to have a critical security flaw that could expose sensitive user-submitted data.
Vulnerability Detail
An issue was discovered in the powermail extension through version 12.4.0 for TYPO3, where it fails to validate the 'mail' parameter in the createAction method. This oversight leads to an Insecure Direct Object Reference (IDOR) vulnerability, allowing unauthenticated attackers to access and display user-submitted data from all forms stored by the extension. The vulnerability poses a moderate risk, with a CVSS score of 4.9, as it could lead to unauthorized data exposure.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 7.5.17.5.1composer require in2code/powermail:7.5.1 -
>= 8.0.0, < 8.5.18.5.1composer require in2code/powermail:8.5.1 -
>= 9.0.0, < 10.9.110.9.1composer require in2code/powermail:10.9.1 -
>= 12.0.0, < 12.4.112.4.1composer require in2code/powermail:12.4.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, restrict access to the powermail extension's createAction method by implementing authentication checks or by limiting access to trusted users only. This can help mitigate the risk until the extension is updated.
Conclusion
The powermail TYPO3 extension has a significant vulnerability that can expose user data due to an Insecure Direct Object Reference. It is crucial for users of this extension to update to the latest versions to safeguard their applications. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for in2code/powermail →
FAQ
CVE-2024-47047 is a vulnerability in the powermail TYPO3 extension that allows unauthorized access to user-submitted data due to inadequate validation of the 'mail' parameter.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to unauthorized exposure of sensitive user data, which could be exploited by attackers for malicious purposes.
The safe versions of the powermail extension are 7.5.1, 8.5.1, 10.9.1, and 12.4.1. Ensure your installation is updated to one of these versions.
Yes, you can implement authentication checks or restrict access to the createAction method as a temporary workaround until the extension is updated.
References
Related vulnerabilities
Recent vulnerabilities recorded for in2code/powermail.
