CVE-2024-55894

Executive Summary

CVE-2024-55894 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 backend user interface, specifically within the deep linking functionality and the Backend User Module. The vulnerability allows an attacker to perform state-changing actions, such as initiating password resets for other backend users or terminating their sessions, by tricking an authenticated backend user into clicking a malicious link. The attack is contingent on specific misconfigurations: the security.backend.enforceReferrer feature being disabled and the BE/cookieSameSite setting being set to lax or none. The CVSS score is 4.3 (Medium), indicating a moderate risk due to the requirement for user interaction and specific configuration conditions. The vulnerability affects TYPO3 versions prior to 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS. No public proof-of-concept (PoC) or exploit code is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity in the wild.

Supply Chain & Package Security

TYPO3 is a PHP-based Content Management Framework distributed as a Composer package. This vulnerability affects the core backend module, not a third-party extension. Users should verify their composer.json for the exact version and update to the patched releases. The package is available via Packagist (typo3/cms-core). No malicious packages or dependency confusion risks are associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
• Base Score: 4.3 (Medium)
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – The attacker does not need prior authentication.
• User Interaction (UI): Required – The victim must click a malicious link.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality Impact (C): None – No data exposure.
• Integrity Impact (I): Low – Password resets or session termination can be performed.
• Availability Impact (A): Low – Session termination can disrupt user access.

Threat Level: Medium. Exploitation requires user interaction and specific misconfigurations, but the impact on integrity and availability is notable for backend operations.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3 backend user interface's deep linking functionality. Deep links are used to navigate directly to specific backend modules or actions. The issue is twofold:

1. CSRF in Deep Links: The deep link mechanism does not properly validate the origin of requests, making it susceptible to CSRF attacks. An attacker can craft a URL that, when clicked by an authenticated backend user, triggers a state-changing action without the user's consent.

2. Incorrect HTTP Method Enforcement: Downstream components, particularly the "Backend User Module," accept state-changing actions via HTTP GET requests instead of requiring POST. This violates the principle of idempotency for GET requests and amplifies the CSRF risk, as a simple link click can trigger actions like password resets or session termination.

Prerequisites for Exploitation:

• The victim must have an active session on the TYPO3 backend.
• The victim must be deceived into clicking a malicious link (e.g., via email or a compromised website).
• The following configurations must be misconfigured:
  • security.backend.enforceReferrer set to false (disabled).
  • BE/cookieSameSite set to lax or none (allowing cross-site cookie inclusion).

Attack Flow:

1. Attacker crafts a URL targeting the Backend User Module, e.g., https://target-typo3-instance/typo3/module/user/UserModule?action=resetPassword&user=admin.
2. Attacker sends this link to an authenticated backend user (e.g., via phishing email).
3. Victim clicks the link while logged into the TYPO3 backend.
4. The browser sends a GET request to the backend, which processes the password reset for the target user (e.g., "admin").
5. The attacker can then use the reset password to gain unauthorized access.

Vulnerable vs. Patched Code

The vulnerability is fixed by enforcing proper CSRF tokens and requiring POST requests for state-changing actions.

Vulnerable Code (TYPO3 < 11.5.42 ELTS, < 12.4.25 LTS, < 13.4.3 LTS):

// In BackendUserModuleController.php (simplified)
public function resetPasswordAction($userUid) {
    // No CSRF token check
    // Accepts GET request
    $user = BackendUserRepository::findByUid($userUid);
    $newPassword = generateRandomPassword();
    $user->setPassword($newPassword);
    $user->save();
    // No token validation
}

Patched Code (TYPO3 >= 11.5.42 ELTS, >= 12.4.25 LTS, >= 13.4.3 LTS):

// In BackendUserModuleController.php (simplified)
public function resetPasswordAction($userUid) {
    // CSRF token validation
    if (!$this->request->hasArgument('__csrfToken') || !GeneralUtility::hmac($this->request->getArgument('__csrfToken'))) {
        throw new \InvalidArgumentException('CSRF token mismatch', 1581862823);
    }
    // Enforce POST method
    if (!$this->request->isMethod('POST')) {
        throw new \InvalidArgumentException('Only POST requests allowed', 1581862824);
    }
    $user = BackendUserRepository::findByUid($userUid);
    $newPassword = generateRandomPassword();
    $user->setPassword($newPassword);
    $user->save();
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A TYPO3 instance with version < 11.5.42 ELTS, < 12.4.25 LTS, or < 13.4.3 LTS.
• The security.backend.enforceReferrer setting disabled.
• The BE/cookieSameSite setting set to lax or none.
• An authenticated backend user session.

Exploitation Steps:

1. Identify the target TYPO3 backend URL (e.g., https://target.com/typo3/).
2. Craft a malicious URL to reset a specific backend user's password:

   https://target.com/typo3/module/user/UserModule?action=resetPassword&user=admin&__csrfToken=attacker_generated_token
   

   Note: The CSRF token may be bypassed if the vulnerable code does not check it.
3. Send the link to the victim via email or embed it in a compromised website.
4. When the victim clicks the link, the password for user "admin" is reset to a random value.
5. The attacker can then use the "Forgot Password" feature or intercept the reset email to gain access.

Alternative Payload (Session Termination):

https://target.com/typo3/module/user/UserModule?action=terminateSession&user=admin

Blue Team

Detection:

• Monitor backend access logs for unusual GET requests to /typo3/module/user/UserModule with parameters like action=resetPassword or action=terminateSession.
• Alert on multiple password reset attempts from the same IP or user agent.
• Check for referrer header anomalies (e.g., missing or unexpected referrers).

Prevention:

• Ensure security.backend.enforceReferrer is set to true.
• Set BE/cookieSameSite to strict.
• Apply the patch by updating TYPO3 to the latest ELTS/LTS version.
• Implement additional CSRF protections, such as custom tokens or double-submit cookies.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /typo3/module/user/UserModule with parameters action=resetPassword or action=terminateSession.
  • Referrer header missing or set to an unexpected domain.
  • User-Agent strings associated with automated tools (e.g., curl, python-requests).

• Host IOCs:

  • Unusual entries in TYPO3 backend access logs (e.g., typo3/log/access.log).
  • Multiple failed login attempts following a password reset.
  • Changes to backend user accounts (e.g., password hash changes) without corresponding user action.

• File IOCs:

  • Modified or new files in typo3conf/ or typo3temp/ indicating potential webshells (though not directly related to this CVE).

Detection Engineering

YARA Rule

rule CVE_2024_55894_CSRF_TYPO3 {
    meta:
        description = "Detects exploitation attempts of CVE-2024-55894 in TYPO3 backend logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55894"
    strings:
        $s1 = "action=resetPassword" nocase
        $s2 = "action=terminateSession" nocase
        $s3 = "/typo3/module/user/UserModule" nocase
    condition:
        any of ($s1, $s2) and $s3
}

Sigma Rule

title: CVE-2024-55894 TYPO3 Backend CSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to TYPO3 backend user module with state-changing actions
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - "/typo3/module/user/UserModule"
            - "action=resetPassword"
            - "action=terminateSession"
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55894 TYPO3 Backend CSRF Exploitation";
    flow:to_server,established;
    http.method; content:"GET";
    http.uri; content:"/typo3/module/user/UserModule";
    http.uri; content:"action=resetPassword" or content:"action=terminateSession";
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2024-55894;
)

Remediation & Mitigation

Immediate Actions:

1. Update TYPO3 to the patched versions:
   • 11.5.42 ELTS
   • 12.4.25 LTS
   • 13.4.3 LTS
2. Verify and enforce the following configurations:
   • Set security.backend.enforceReferrer = true in typo3conf/LocalConfiguration.php.
   • Set BE/cookieSameSite = strict in the same file.
3. Review backend user accounts for any unauthorized changes.

Long-Term Mitigations:

• Implement Web Application Firewall (WAF) rules to block GET requests to state-changing endpoints.
• Conduct regular security audits of TYPO3 configurations.
• Educate backend users about phishing risks and the importance of not clicking suspicious links.
• Monitor for similar CSRF vulnerabilities in custom extensions.

Patch Verification:

• After updating, verify the version in the TYPO3 backend under "System > Configuration" or via CLI:

  php bin/typo3 --version
  

• Check that the enforceReferrer setting is active:

  // In typo3conf/LocalConfiguration.php
  'security' => [
      'backend' => [
          'enforceReferrer' => true,
      ],
  ],
  

Valters IT
DevSecOps & Cyber Threat Intelligence