CVE-2024-30262 (published 2024-04-09T17:16Z)

Contao is an open source content management system. Prior to version 4.13.40, when a frontend member changes their password in the personal data or the password lost module, the corresponding remember-me tokens are not removed. If someone compromises an account and is able to get a remember-me token, changing the password would not be enough to reclaim control over the account. Version 4.13.40 contains a fix for the issue. As a workaround, disable "Allow auto login" in the login module.\n


Weakness information:
cwe_id: NVD-CWE-noinfo
cwe_name: Insufficient Information
description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
extended_description: Insufficient Information

Fix information:
repo_url: https://github.com/contao/contao
commit_details: repo_url: https://github.com/contao/contao
author: David Greminger
author_date: 2024-04-09 07:18:49+02:00
msg: Merge pull request from GHSA-r4r6-j2j3-7pp5

Co-authored-by: Leo Feyer <1192057+leofeyer@users.noreply.github.com>
repository: repo_url: https://github.com/contao/contao
repo_name: contao/contao
description: Contao Open Source CMS
repo_language: PHP
owner: contao
file_changes: filename: RememberMeRepository.php
change_type: ModificationType.MODIFY
diff: @@ -119,4 +119,16 @@ class RememberMeRepository extends ServiceEntityRepository
 
         $this->_em->flush();
     }
+
+    public function deleteByUsername(string $username): void
+    {
+        $qb = $this->_em->createQueryBuilder();
+        $qb
+            ->delete($this->_entityName, 'rm')
+            ->where('rm.username = :username')
+            ->setParameter('username', $username)
+        ;
+
+        $qb->getQuery()->execute();
+    }
 }

programming_language: PHP
filename: services.yml
change_type: ModificationType.MODIFY
diff: @@ -527,6 +527,7 @@ services:
 
     contao.repository.remember_me:
         class: Contao\CoreBundle\Repository\RememberMeRepository
+        public: true
         arguments:
             - '@doctrine'
 

programming_language: CoffeeScript
filename: ModuleChangePassword.php
change_type: ModificationType.MODIFY
diff: @@ -178,6 +178,8 @@ class ModuleChangePassword extends Module
 			$objMember->password = $objNewPassword->value;
 			$objMember->save();
 
+			System::getContainer()->get('contao.repository.remember_me')->deleteByUsername($objMember->username);
+
 			// Create a new version
 			if ($GLOBALS['TL_DCA'][$strTable]['config']['enableVersioning'] ?? null)
 			{

programming_language: PHP
filename: ModulePassword.php
change_type: ModificationType.MODIFY
diff: @@ -259,6 +259,8 @@ class ModulePassword extends Module
 				$objMember->password = $objWidget->value;
 				$objMember->save();
 
+				System::getContainer()->get('contao.repository.remember_me')->deleteByUsername($objMember->username);
+
 				$optInToken->confirm();
 
 				// Create a new version

programming_language: PHP
filename: ModulePersonalData.php
change_type: ModificationType.MODIFY
diff: @@ -303,6 +303,11 @@ class ModulePersonalData extends Module
 						// Set the new field in the member model
 						$blnModified = true;
 						$objMember->$field = $varValue;
+
+						if ($objWidget instanceof FormPassword)
+						{
+							System::getContainer()->get('contao.repository.remember_me')->deleteByUsername($objMember->username);
+						}
 					}
 				}
 			}

programming_language: PHP