Unauthenticated Employee Record Modification in HR Extension

Executive Summary

This is a Broken Access Control vulnerability in the TYPO3 extension 'Telephone Directory' (versions 6.1.2 and below). The flaw allows unauthenticated attackers to modify employee records by exploiting a missing HMAC validation in the update action. Attackers only need to know an employee's UID to send a direct POST request and overwrite the record without authorization.

Useful 0 Not Useful 0

Detection Guidance

Check for unauthorized modifications to employee records by reviewing logs for POST requests to the update action without valid HMAC or ownership verification. Inspect network traffic for suspicious POST requests targeting the vulnerable endpoint.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected extension, an attacker could modify employee records, potentially altering sensitive data like contact information or job details. This could lead to data integrity issues, unauthorized changes, or misuse of employee information without detection.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could violate compliance requirements by allowing unauthorized modifications to employee data. GDPR requires data integrity and access controls, while HIPAA mandates strict access controls for sensitive information. Exploiting this flaw may lead to non-compliance and potential legal consequences.

Useful 0 Not Useful 0

Mitigation Strategies

Update the Telephone Directory extension to version 6.2.0 or later immediately. Disable the extension if an update is not possible. Review and restrict access to employee records until patched.

Useful 0 Not Useful 0