--- title: "TYPO3-PSA-2019-006: Security Misconfiguration since TYPO3 9.4.0" url: "https://news.typo3.com/security/advisory/typo3-psa-2019-006" description: It has been discovered that TYPO3 is susceptible to security misconfiguration. image: "https://news.typo3.com/_assets/d1e01514e4c4a5b3147940fa2ec50682/Images/og-image-news.jpg" date: 2026-06-11 modified: 2026-06-11 categories: - "Developer & Technology" - Public Service Announcement --- # TYPO3-PSA-2019-006: Security Misconfiguration since TYPO3 9.4.0 - [Developer & Technology](https://news.typo3.com/article/category/developer-technology) - Security / [Public Service Announcement](https://news.typo3.com/article/category/security/public-service-announcement) TYPO3-PSA-2019-006: Security Misconfiguration since TYPO3 9.4.0 =============================================================== 07 May 2019 ![A laptop screen displaying a list of security advisories](https://news.typo3.com/typo3temp/assets/_processed_/d/c/csm_security_blog_default_77f8e86036.webp) It has been discovered that TYPO3 is susceptible to security misconfiguration. - ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/b8266fdc667b773926c59081862ab148.jpeg)[Oliver Hader](https://news.typo3.com/article/author/oliver-hader) - **Release Date:** May 7, 2019 - **Component Type:** Salted Passwords (bundled in TYPO3 core package, ext:core) - **Impact:** Security Misconfiguration - **Affected Versions:** TYPO3 9.4.0 through 9.5.5 ### Problem Description Salted Passwords was bundled in TYPO3 as *ext:saltedpasswords* and got merged with the core component *ext:core* with TYPO3 v9.4.0 (see [documentation of issue #85833](https://docs.typo3.org/typo3cms/extensions/core/Changelog/9.4/Deprecation-85833-ExtensionSaltedpasswordsMergedIntoCoreExtension.html)). Extensions that are taking care of user generation or password manipulation in particular are checking whether *ext:saltedpassword* is installed in order to make use of the according API calls for hashing passwords. Some of these extensions provide a fallback to MD5 hashing - without using a salt - or don’t modify passwords at all - which leads to plain text passwords being stored. This is considered as severe decrease in security. The following example demonstrates extension source code that has been working correctly until TYPO3 v9.4.0 and was falling back to plain text passwords since system extension *saltedpasswords* was no longer available. ``` public function handleNewPassword(string $password) { if (ExtensionManagementUtility::isLoaded('saltedpasswords')) { $factory = SaltFactory::getSaltingInstance(); // return password hash using random salt return $factory->getHashedPassword($password); } else { // return plain text password return $password; } } ``` ### Solution Update to TYPO3 version 9.5.6 that fixes the problem described by simulating the existence of *ext:saltedpasswords*, even if it is actually not, but provided by ext:core instead. **Important: Analyse whether site is being affected and needs to be migrated** \- search for user passwords that are not hashed and are stored in plain-text or MD5 \- If possible upgrade these passwords to use salted passwords or remove accounts \- these checks must be done at least for ***be\_users*** and ***fe\_users*** database tables The following example shows all passwords of frontend users’ database table fe\_users - first two passwords seem to be correctly using salted hashes (*$2y$* referring to *bcrypt*), last two passwords seem to be plain-text or MD5 hash (32 hex characters). ``` mysql> SELECT uid, password FROM fe_users; +-----+--------------------------------------------------------------+ | uid | password | +-----+--------------------------------------------------------------+ | 1 | $2y$12$Q1w5mzRlTxSYQ632yED4y.HHRjrfmFHA.Q7Rh8Zv4ePzauzTu/kQa | | 2 | $2y$12$xfo8lDu01uHtnQdIFqqoEe0Jyb3zuQFzqbrnPoR4wJfmuWG.H/vte | | 3 | $eDie1zae:Ra3bae4thi | | 4 | 87b28920b0fa3da71160d9d12b2da1da | +-----+--------------------------------------------------------------+ 4 rows in set (0.00 sec) ``` The following example uses a regular expression query containing common hash variants to be used as prefix. In case custom hashing algorithms are used the query has to be adjusted accordingly - find more details at . ``` mysql> SELECT uid, password FROM fe_users -> WHERE password NOT REGEXP BINARY -> '^\\$(argon2i|pbkdf2-sha256|P|1|2|2a|2x|2y|5|6)\\$.+'; +-----+----------------------------------+ | uid | password | +-----+----------------------------------+ | 3 | $eDie1zae:Ra3bae4thi | | 4 | 87b28920b0fa3da71160d9d12b2da1da | +-----+----------------------------------+ 2 rows in set (0.00 sec) ``` Maintainers of TYPO3 extensions are advised to update their sources in order to enforce using salted passwords and enhance overall security concerning storing user credentials. **Maintainers of TYPO3 extensions are advised to enforce Salted Passwords** Salted Passwords have been introduced in TYPO3 v4.3 around 9 years ago and became mandatory with TYPO3 v6.2 LTS. Extensions have to enforce using salted passwords without falling back to weaker algorithms not using salts or even plain-text. In case passwords cannot be salted the process shall be halted and logged. ### General Advice Follow the recommendations that are given in the [TYPO3 Security Guide](https://docs.typo3.org/typo3cms/CoreApiReference/Security/Index.html#security-guidelines). Please subscribe to the [typo3-announce](http://lists.typo3.org/cgi-bin/mailman/listinfo/typo3-announce) mailing list. ![](https://news.typo3.com/typo3temp/assets/t3g/blog/gravatar/cc7cba9757f98fbe05023a139119df74.jpeg) About the Author [Oliver Hader](https://news.typo3.com/article/author/oliver-hader) Core Developer at TYPO3 GmbH,Hof, Germany [Website](https://typo3.com)[Twitter](https://twitter.com/ohader)[LinkedIn](https://www.linkedin.com/in/oliverhader/)[Xing](https://www.xing.com/profile/Oliver_Hader) Oliver started to work with TYPO3 in 2005 and was fascinated by the product and its universe. Since 2007 he is member of the TYPO3 Core Team. After going back to university in 2014 for achieving a postgraduate master degree in internet web science, he is now researching on advanced web technology topics in general and for TYPO3 in particular. In his spare time, Oliver loves to go cycling cross-country in the uplands around Hof (Germany) in northern Bavaria - at the region where he's living as well. [More posts by this author](https://news.typo3.com/article/author/oliver-hader)