CVE-2024-55920

Executive Summary

CVE-2024-55920 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 Content Management Framework. The vulnerability resides in the backend user interface's deep linking functionality and is compounded by downstream components (specifically the Dashboard Module) that accept state-changing actions via HTTP GET requests without enforcing proper HTTP method validation. Successful exploitation requires an authenticated backend user to be tricked into clicking a malicious link while specific security configurations are misconfigured (security.backend.enforceReferrer disabled and BE/cookieSameSite set to lax or none). An attacker can manipulate the victim's dashboard configuration, leading to unauthorized changes. The CVSS score is 4.3 (Medium), and while no public proof-of-concept (PoC) or exploit code is available, the vulnerability is considered a significant risk due to the potential for social engineering attacks against backend users.

Supply Chain & Package Security

TYPO3 is a PHP-based CMS distributed via Composer and its own Extension Repository. This vulnerability affects the core framework, not a third-party extension. The fix is included in the official TYPO3 releases. Users should ensure their Composer dependencies are updated to the patched versions. No malicious packages have been identified in the supply chain related to this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network – The attack is carried out over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – The attacker does not need to be authenticated.
• User Interaction (UI): Required – The victim must click a malicious link.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None – No data is exposed.
• Integrity (I): Low – The attacker can modify the victim's dashboard configuration.
• Availability (A): None – No denial of service is possible.

Threat Level: Medium. The requirement for user interaction and specific misconfigurations reduces the likelihood of widespread exploitation, but the potential for targeted attacks against backend users is real.

Deep Dive & Mechanics

The vulnerability is a classic CSRF issue combined with improper HTTP method validation.

1. CSRF in Deep Links: TYPO3's backend uses deep links (e.g., typo3/index.php?route=/module/dashboard) to navigate to specific modules. The deep link functionality does not include a CSRF token or other anti-forgery mechanisms. This allows an attacker to craft a URL that performs a state-changing action on behalf of an authenticated user.

2. HTTP GET Method Abuse: The Dashboard Module, a downstream component, accepts state-changing actions (e.g., adding, removing, or reordering widgets) via HTTP GET requests. The standard practice is to use POST, PUT, or DELETE for such actions. By accepting GET requests, the module makes it trivial for an attacker to craft a malicious link that triggers these actions.

3. Exploitation Conditions: For the attack to succeed, the victim must:

   • Have an active session in the TYPO3 backend.
   • Click a malicious link (e.g., sent via email or hosted on a compromised site).
   • The TYPO3 instance must have security.backend.enforceReferrer set to false (default is true in modern versions) and BE/cookieSameSite set to lax or none (default is strict). These misconfigurations allow the browser to send the session cookie with the cross-origin request.

4. Attack Flow:

   • Attacker crafts a URL like: https://victim-typo3.com/typo3/index.php?route=/module/dashboard&action=addWidget&widget=maliciousWidget
   • Attacker sends this link to the victim (e.g., via email).
   • Victim, authenticated in the TYPO3 backend, clicks the link.
   • The browser sends a GET request to the TYPO3 backend with the victim's session cookie.
   • The backend processes the request, adding a malicious widget to the victim's dashboard.

Vulnerable vs. Patched Code

The fix involves two changes:

1. Adding CSRF protection to the deep link handling.
2. Enforcing HTTP method validation in the Dashboard Module to only accept POST requests for state-changing actions.

Vulnerable Code (Conceptual - Dashboard Module):

// Vulnerable: Accepts GET requests for state changes
class DashboardController {
    public function addWidgetAction() {
        $widget = $_GET['widget'];
        // ... add widget to user's dashboard
    }
}

Patched Code (Conceptual - Dashboard Module):

// Patched: Only accepts POST requests
class DashboardController {
    public function addWidgetAction() {
        if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
            throw new \TYPO3\CMS\Core\Exception('Invalid request method');
        }
        // CSRF token check
        if (!$this->request->hasArgument('__csrfToken') || !$this->security->checkToken($this->request->getArgument('__csrfToken'))) {
            throw new \TYPO3\CMS\Core\Exception('CSRF token mismatch');
        }
        $widget = $this->request->getArgument('widget');
        // ... add widget to user's dashboard
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A TYPO3 instance with a vulnerable version (e.g., 12.4.24 LTS).
• The security.backend.enforceReferrer setting must be disabled.
• The BE/cookieSameSite setting must be set to lax or none.
• A valid backend user session.

Exploitation Steps:

1. Craft the Malicious URL: Identify the exact parameters needed to manipulate the dashboard. For example, to add a widget:

   https://victim-typo3.com/typo3/index.php?route=/module/dashboard&action=addWidget&widget=typo3-extension-example
   

2. Deliver the Payload: Send the URL to the victim via email or host it on a malicious site with an auto-redirect or a clickable link.

3. Trigger the Attack: The victim clicks the link while authenticated. The browser sends the GET request with the session cookie, and the dashboard is modified.

Example HTML for Phishing Email:

<html>
<body>
    <p>Dear User,</p>
    <p>Please click the link below to review your dashboard settings:</p>
    <a href="https://victim-typo3.com/typo3/index.php?route=/module/dashboard&action=addWidget&widget=malicious">Review Dashboard</a>
</body>
</html>

Blue Team

Detection and Prevention:

1. Monitor for Suspicious GET Requests: Look for HTTP GET requests to backend routes that should only accept POST requests. Example log entry:

   192.168.1.100 - - [10/Dec/2024:14:23:45 +0000] "GET /typo3/index.php?route=/module/dashboard&action=addWidget HTTP/1.1" 200 1234 "-" "Mozilla/5.0"
   

2. Check Referrer Headers: If security.backend.enforceReferrer is enabled, the server will reject requests with missing or incorrect referrer headers. Monitor for requests with Referer: https://attacker.com/.

3. Audit Configuration: Ensure security.backend.enforceReferrer is set to true and BE/cookieSameSite is set to strict.

4. User Education: Train backend users to be cautious of links in emails and to always verify the URL before clicking.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP GET requests to /typo3/index.php?route=/module/dashboard with unexpected action parameters.
  • Requests with Referer headers pointing to known malicious domains.
  • Unusual patterns in backend access logs, such as rapid requests to dashboard actions.

• Host IOCs:

  • Modified dashboard configuration files (e.g., user_[uid].php in typo3temp/var/).
  • Presence of unexpected widgets or dashboard layouts.

• Log IOCs:

  • TYPO3 system log entries showing dashboard modifications without a corresponding POST request.
  • Web server access logs showing GET requests to backend routes with query parameters.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_55920_Exploit {
    meta:
        description = "Detects HTTP GET requests targeting TYPO3 dashboard actions"
        author = "Valters IT"
        date = "2024-12-10"
        reference = "CVE-2024-55920"
    strings:
        $s1 = "route=/module/dashboard" ascii wide nocase
        $s2 = "action=addWidget" ascii wide nocase
        $s3 = "action=removeWidget" ascii wide nocase
        $s4 = "action=reorderWidget" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4) or
        ($s1 and any of ($s2, $s3, $s4))
}

Sigma Rule

title: TYPO3 Backend Dashboard CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP GET requests to TYPO3 backend dashboard actions, indicating a potential CSRF attack (CVE-2024-55920).
author: Valters IT
date: 2024-12-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55920
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'route=/module/dashboard'
            - 'action=addWidget'
            - 'action=removeWidget'
            - 'action=reorderWidget'
    condition: selection
falsepositives:
    - Legitimate use of GET for non-state-changing actions (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55920 TYPO3 Backend Dashboard CSRF Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"route=/module/dashboard"; http.uri; content:"action="; pcre:"/(addWidget|removeWidget|reorderWidget)/Ui"; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3: Update to the patched versions: 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS.
2. Enforce Referrer Check: Set $GLOBALS['TYPO3_CONF_VARS']['BE']['enforceReferrer'] = true; in typo3conf/LocalConfiguration.php.
3. Set Cookie SameSite to Strict: Set $GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'strict';.

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) to block suspicious GET requests to backend routes.
• Conduct regular security audits of TYPO3 configurations.
• Educate backend users on phishing and social engineering risks.
• Monitor for new CVEs and apply patches promptly.

Workarounds:

• No official workarounds are available. The only effective mitigation is to apply the patch and enforce the security settings.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert