CVE-2024-55892

Executive Summary

CVE-2024-55892 is a medium-severity vulnerability in the TYPO3 Content Management Framework, specifically within the TYPO3/CMS/Core/Http/Uri component. The flaw arises when applications parse externally provided URLs (e.g., via query parameters) and validate the host of the parsed URL. If the URL passes validation but is later used in a redirect or server-side request, it can lead to open redirect or Server-Side Request Forgery (SSRF) attacks. This vulnerability affects all TYPO3 versions prior to the patched releases: 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, and 13.4.3. No public proof-of-concept or exploit code is currently available, and the EPSS score is 0.0%, indicating low exploitation activity. However, given the widespread use of TYPO3, this vulnerability should be patched promptly.

Supply Chain & Package Security

TYPO3 is a PHP-based CMS distributed via Composer. The vulnerable component TYPO3/CMS/Core/Http/Uri is part of the core framework. Organizations using TYPO3 should verify their Composer lock files and ensure they are on a patched version. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: Required (victim clicks a crafted link)
• Scope: Unchanged
• Confidentiality Impact: Low (potential SSRF data leak)
• Integrity Impact: Low (open redirect)
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the combination of open redirect and SSRF potential can be leveraged for phishing campaigns or internal network reconnaissance.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3/CMS/Core/Http/Uri class, which is used to parse and validate URLs. When an application receives a URL from an external source (e.g., a redirect query parameter), it uses this class to parse the URL and then validates the host against an allowlist. However, due to improper handling of URL components (such as user info, fragments, or malformed schemes), the validation can be bypassed. For example, an attacker could craft a URL like http://evil.com@legitimate.com or use a different scheme like javascript: to pass host validation but still redirect the user to a malicious site.

The core issue is that the Uri class may not correctly normalize or canonicalize the URL before validation, allowing the attacker to embed a different host in the user info section or use a scheme that bypasses host checks. After validation, the URL is used in a redirect or server-side request, leading to open redirect or SSRF.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: Does not properly normalize URL before host validation
$uri = new Uri($userInput);
if (in_array($uri->getHost(), $allowedHosts)) {
    // Redirect or fetch URL
    header('Location: ' . $uri);
}

Patched Code (Conceptual):

// Patched: Normalize and validate the URL more strictly
$uri = new Uri($userInput);
$normalizedHost = strtolower($uri->getHost());
if (in_array($normalizedHost, $allowedHosts) && $uri->getScheme() === 'https') {
    // Additional checks for user info and path
    if ($uri->getUserInfo() === '' && $uri->getFragment() === '') {
        header('Location: ' . $uri->__toString());
    }
}

The patch ensures that the host is normalized, the scheme is restricted, and user info/fragment components are empty before proceeding.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• A TYPO3 instance with a vulnerable version (e.g., 12.4.24 LTS).
• A publicly accessible endpoint that uses Uri to parse a redirect parameter.

Exploitation Steps:

1. Identify a vulnerable endpoint, e.g., https://target.com/redirect?url=.
2. Craft a malicious URL that bypasses host validation:
   • Open redirect: https://target.com/redirect?url=http://evil.com@legitimate.com
   • SSRF: https://target.com/redirect?url=http://169.254.169.254/latest/meta-data/
3. Send the crafted link to a victim or use it in a phishing campaign.
4. For SSRF, observe server-side requests to internal resources.

No public exploit code is available.

Blue Team (Defender)

Detection Steps:

1. Monitor web server logs for unusual redirect parameters containing @ or IP addresses.
2. Use the detection rules below to identify exploitation attempts.
3. Verify that all TYPO3 instances are updated to patched versions.

Indicators of Compromise (IOCs)

• Network IOCs:

  • URLs containing @ in the host portion (e.g., http://evil.com@legitimate.com).
  • Requests to internal IP addresses (e.g., 169.254.169.254, 10.0.0.1) via redirect parameters.
  • Unusual schemes like javascript: or data: in redirect parameters.

• File IOCs:

  • Modified typo3/sysext/core/Classes/Http/Uri.php file (if attacker modified source).

• Log IOCs:

  • Web server logs showing redirect parameters with suspicious patterns.

Detection Engineering

YARA Rule

rule CVE_2024_55892_TYPO3_Uri_Bypass {
    meta:
        description = "Detects attempts to exploit CVE-2024-55892 in TYPO3 via malicious redirect URLs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55892"
    strings:
        $s1 = "redirect=" nocase
        $s2 = "@" nocase
        $s3 = "169.254.169.254" nocase
        $s4 = "javascript:" nocase
    condition:
        any of ($s*) and #s1 > 0
}

Sigma Rule

title: CVE-2024-55892 TYPO3 Open Redirect / SSRF Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests with suspicious redirect parameters targeting TYPO3
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'redirect='
        cs-uri-query|contains|any:
            - '@'
            - '169.254.169.254'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of @ in email addresses (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55892 TYPO3 Open Redirect / SSRF Attempt"; flow:to_server,established; content:"redirect="; http_uri; content:"@"; http_uri; distance:0; content:"169.254.169.254"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3 to the patched versions: 9.5.49 ELTS, 10.4.48 ELTS, 11.5.42 LTS, 12.4.25 LTS, or 13.4.3.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block URLs containing @ or internal IP addresses in redirect parameters.
3. Restrict the redirect functionality to only allow relative paths or a predefined allowlist of URLs.

Long-term Measures:

• Regularly update TYPO3 and all extensions.
• Conduct code reviews for any custom code using Uri to ensure proper validation.
• Monitor for similar vulnerabilities in the TYPO3 ecosystem.

Valters IT
Securing Digital Frontiers