CVE-2024-30173: 
PHP vulnerability analysis and mitigation

A vulnerability has been identified in the OpenID Connect Authentication (oidc) TYPO3 extension, tracked as CVE-2024-30173. The issue was discovered and disclosed on April 2, 2024, affecting versions 2.0.0 and below of the causal/oidc Composer package. This authentication bypass vulnerability impacts the authentication service of the extension (TYPO3 Advisory).

The vulnerability stems from the authentication service's failure to verify the OpenID Connect authentication state from the user lookup chain. Instead, it authenticates any valid frontend user from the user lookup chain where the frontend user field 'tx_oidc' is not empty. This becomes exploitable in scenarios where either ext:felogin is active or when $GLOBALS['TYPO3_CONF_VARS']['FE']['checkFeUserPid'] is disabled. The vulnerability has been assigned a CVSS v3.1 base score of 6.0 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N/E:F/RL:O/RC:C (GitHub Advisory).

The vulnerability allows attackers to bypass authentication controls and login to OpenID Connect frontend user accounts by providing a valid username and any password, potentially compromising user account security (TYPO3 Advisory).

The vulnerability can be exploited by an attacker without requiring special privileges or user interaction, though it requires high attack complexity. The attack vector is network-accessible, making it possible to exploit remotely (GitHub Advisory).

The vulnerability has been fixed in version 2.1.0 of the extension. Users are strongly advised to update to this version as soon as possible. The update is available through the TYPO3 extension manager, packagist, and can be downloaded directly from the TYPO3 extension repository (TYPO3 Advisory).