TYPO3 CMS Authentication Bypass Vulnerability in typo3/cms-core
Summary
GHSA-x4rj-f7m6-42c3: TYPO3 CMS Authentication Bypass vulnerability. Affects typo3/cms-core across 3 version ranges.
>= 7.0.0, < 7.6.30
>= 8.0.0, < 8.7.17
>= 9.0.0, < 9.3.2
Fixed in 7.6.30, 8.7.17 or 9.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 CMS is an open-source content management system used for creating and managing websites. The typo3/cms-core package is a mandatory system component of TYPO3 CMS. It includes the Salted Password system extension, which is responsible for securely storing and authenticating user passwords. However, a vulnerability has been discovered in the Salted Password system extension that allows for authentication bypass under certain conditions.
Vulnerability Detail
The TYPO3 CMS Salted Password system extension is vulnerable to an authentication bypass when using hashing methods that are related by PHP class inheritance. In standard TYPO3 core distributions, if the blowfish hashing algorithm is used for storing passwords and MD5 is set as the default hashing algorithm, an attacker can override the blowfish hashing and gain unauthorized access to user accounts by knowing a valid username. This vulnerability does not affect TYPO3 installations that use the Portable PHP hashing algorithm (PHPass) by default.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 7.0.0, < 7.6.307.6.30composer require typo3/cms-core:7.6.30 -
>= 8.0.0, < 8.7.178.7.17composer require typo3/cms-core:8.7.17 -
>= 9.0.0, < 9.3.29.3.2composer require typo3/cms-core:9.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround for this vulnerability. However, TYPO3 CMS users can mitigate the risk by ensuring that the blowfish hashing algorithm is used as the default hashing algorithm and not overridden by MD5.
Conclusion
The TYPO3 CMS Salted Password system extension is vulnerable to an authentication bypass when using certain hashing methods. TYPO3 CMS users should update their installations to the fixed versions mentioned above to mitigate the vulnerability. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for typo3/cms-core →
FAQ
TYPO3 CMS is an open-source content management system used for creating and managing websites. It provides a flexible and extensible platform for building web applications.
The Salted Password system extension is a mandatory component of TYPO3 CMS that handles the secure storage and authentication of user passwords. It uses various hashing algorithms to protect user passwords.
The vulnerability occurs when the blowfish hashing algorithm is used for storing passwords and MD5 is set as the default hashing algorithm. An attacker can override the blowfish hashing and gain unauthorized access to user accounts by knowing a valid username.
TYPO3 CMS versions 7.0.0 to 7.6.30, 8.0.0 to 8.7.17, and 9.0.0 to 9.3.2 are affected by this vulnerability.
To fix this vulnerability, update your TYPO3 CMS installation to version 8.7.17 or later if you are using TYPO3 CMS 8.x, or update to version 9.3.2 or later if you are using TYPO3 CMS 9.x.
References
Related vulnerabilities
Recent vulnerabilities recorded for typo3/cms-core.
