CVE-2024-55893

Executive Summary

CVE-2024-55893 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 backend user interface, specifically affecting the deep linking functionality and the Log Module. An attacker can trick an authenticated backend user into performing unintended state-changing actions, such as deleting log entries, by sending a malicious link. The vulnerability is exploitable when the security.backend.enforceReferrer feature is disabled and the BE/cookieSameSite configuration is set to lax or none. The CVSS score is 4.3 (Medium), and while no public exploit code exists, the attack vector is straightforward. Patches are available in the latest ELTS and LTS releases.

Supply Chain & Package Security

This vulnerability affects the TYPO3 CMS, a widely used open-source content management framework. As a PHP-based application, it is distributed via the TYPO3 Extension Repository (TER) and Composer. The vulnerability is in the core backend UI, not a third-party extension, making it a direct supply chain risk for all TYPO3 installations. Administrators must ensure they are using a patched version to prevent exploitation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Base Score: 4.3 (Medium)
• Attack Vector: Network (AV:N) – The attacker can trigger the exploit remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – The attacker does not need authentication.
• User Interaction: Required (UI:R) – The victim must click a malicious link.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: Low (I:L) – Log entries can be deleted.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The vulnerability requires user interaction and specific misconfigurations, but it can lead to the deletion of audit logs, which may hinder forensic investigations.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3 backend user interface's deep linking functionality. Deep links are used to navigate directly to specific backend modules or actions. The issue is twofold:

1. CSRF in Deep Links: The backend does not properly validate the origin of requests when processing deep links. An attacker can craft a URL that, when clicked by an authenticated backend user, triggers a state-changing action without the user's consent.

2. Incorrect HTTP Method Enforcement: Downstream components, particularly the Log Module, accept state-changing actions via HTTP GET requests instead of requiring POST. This violates the principle of idempotency for GET requests and makes CSRF attacks easier.

The exploitation chain:

• The attacker identifies a TYPO3 instance with security.backend.enforceReferrer disabled and BE/cookieSameSite set to lax or none.
• The attacker crafts a malicious URL that targets the Log Module's delete action, e.g., https://target-typo3.com/typo3/module/log/delete?token=...&entry=123.
• The attacker sends this URL to the victim (e.g., via email or a compromised website).
• The victim, authenticated to the TYPO3 backend, clicks the link.
• The browser sends a GET request to the backend, which processes the deletion of log entries.

The vulnerability is patched by enforcing CSRF tokens and requiring POST requests for state-changing actions.

Vulnerable vs. Patched Code

The vulnerable code likely resides in the backend routing and controller logic. Below is a conceptual comparison.

Vulnerable Code (GET-based action):

// In LogController.php
public function deleteAction($entryId) {
    // No CSRF check, accepts GET
    $logEntry = $this->logRepository->findById($entryId);
    if ($logEntry) {
        $this->logRepository->remove($logEntry);
        $this->persistenceManager->persistAll();
    }
    // Redirect back
    $this->redirect('list');
}

Patched Code (POST-only with CSRF token):

// In LogController.php
public function deleteAction($entryId) {
    // CSRF token validation
    if (!$this->request->hasArgument('__csrfToken') || 
        !$this->securityService->validateToken($this->request->getArgument('__csrfToken'))) {
        throw new \TYPO3\CMS\Core\Exception('Invalid CSRF token');
    }
    // Ensure POST method
    if (!$this->request->isPost()) {
        throw new \TYPO3\CMS\Core\Exception('Only POST requests allowed');
    }
    $logEntry = $this->logRepository->findById($entryId);
    if ($logEntry) {
        $this->logRepository->remove($logEntry);
        $this->persistenceManager->persistAll();
    }
    $this->redirect('list');
}

Exploitation & Lab Setup

Red Team (Attacker)

Lab Setup:

• Install a vulnerable TYPO3 version (e.g., 12.4.24 LTS) on a local server.
• Configure $GLOBALS['TYPO3_CONF_VARS']['BE']['enforceReferrer'] = false; and $GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'lax'; in typo3conf/LocalConfiguration.php.
• Create a backend user with access to the Log Module.

Exploitation Steps:

1. Identify the target TYPO3 backend URL and obtain a valid CSRF token (if needed) by inspecting the Log Module's list view.
2. Craft a malicious URL:

   http://target-typo3.com/typo3/module/log/delete?token=VALID_CSRF_TOKEN&entry=1
   

3. Send the URL to the victim via email or a phishing page.
4. When the victim clicks the link, the log entry is deleted.

Note: No public exploit code is available, but the above demonstrates the attack.

Blue Team (Defender)

Detection:

• Monitor for GET requests to /typo3/module/log/delete or similar state-changing endpoints.
• Alert on requests to backend modules without a valid Referer header.
• Enable security.backend.enforceReferrer and set BE/cookieSameSite to strict.

Hunting:

• Search logs for unusual patterns of log entry deletions.
• Correlate deletions with user sessions and IP addresses.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to /typo3/module/log/delete with parameters like entry and token.
• Logs: Sudden deletion of multiple log entries in the TYPO3 backend log.
• Configuration: security.backend.enforceReferrer set to false and BE/cookieSameSite set to lax or none.

Detection Engineering

YARA Rule

rule TYPO3_CSRF_Log_Delete {
    meta:
        description = "Detects CSRF exploitation attempts against TYPO3 Log Module"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55893"
    strings:
        $url_pattern = "/typo3/module/log/delete" ascii wide nocase
        $get_method = "GET" ascii wide nocase
    condition:
        $url_pattern and $get_method
}

Sigma Rule

title: TYPO3 Backend Log Module CSRF Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects GET requests to TYPO3 Log Module delete action, indicating possible CSRF attack
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: "/typo3/module/log/delete"
    condition: selection
falsepositives:
    - Legitimate use of deep links (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"TYPO3 Backend Log Module CSRF Attempt"; flow:to_server; content:"GET"; http_method; content:"/typo3/module/log/delete"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3 to version 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS.
2. Enable security.backend.enforceReferrer in typo3conf/LocalConfiguration.php:

   $GLOBALS['TYPO3_CONF_VARS']['BE']['enforceReferrer'] = true;
   

3. Set BE/cookieSameSite to strict:

   $GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'strict';
   

Long-term Measures:

• Implement Web Application Firewall (WAF) rules to block GET requests to state-changing endpoints.
• Conduct regular security audits of TYPO3 configurations.
• Educate backend users about phishing risks.

Workarounds: No known workarounds exist; patching is required.

Valters IT
Securing Digital Frontiers