GHSA-8c25-vj2w-p72j: 
PHP vulnerability analysis and mitigation

A Cross-Site Scripting (XSS) vulnerability was discovered in TYPO3 CMS's Frontend User Login component, identified as TYPO3-CORE-SA-2018-008. The vulnerability was disclosed on December 11, 2018, affecting TYPO3 CMS versions 7.0.0-7.6.31, 8.0.0-8.7.20, and 9.0.0-9.5.1. This security issue was assigned a moderate severity rating with a CVSS score of 6.1 (TYPO3 Advisory, GitHub Advisory).

The vulnerability stems from improper encoding of user input in the login status display functionality within the website frontend. The issue specifically affects template patterns using ###FEUSER_[fieldName]### with the system extension felogin for regular frontend rendering. These patterns can be defined individually using TypoScript setting config.USERNAME_substToken. The vulnerability has been assigned a CVSS v3.1 base score of 6.1 with the following vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (GitHub Advisory).

The vulnerability allows for cross-site scripting attacks in the website frontend. To exploit this vulnerability, an attacker would need either a backend user account or a frontend user account with permissions to modify their user profile. The impact is considered moderate, with potential for low-level breaches in both confidentiality and integrity, though availability is not affected (TYPO3 Advisory).

Exploitation of this vulnerability requires a valid user account - either a backend user or a frontend user with the ability to modify their user profile. The attack vector is network-based with low attack complexity, though user interaction is required for successful exploitation (GitHub Advisory).

The vulnerability has been patched in TYPO3 versions 7.6.32, 8.7.21, and 9.5.2. As a security measure, the htmlSpecialChars property is enabled by default for template patterns rendered with system extension felogin. Customization of the rendering process is possible by adjusting TypoScript settings in plugin.tx_felogin_pi1.userfields.fieldName.htmlSpecialChars (TYPO3 Advisory).

The vulnerability was reported by Thomas Löffler and fixed by TYPO3 core team member Benni Mack. The TYPO3 team has recommended users to follow the TYPO3 Security Guide and subscribe to the typo3-announce mailing list for future security updates (TYPO3 Advisory).