CVE-2024-55921

Executive Summary

CVE-2024-55921 is a critical Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 Content Management Framework, specifically affecting the backend user interface's deep link functionality. The vulnerability allows an attacker to trick an authenticated backend administrator into performing unintended state-changing actions, such as retrieving and installing third-party extensions from the TYPO3 Extension Repository. In the worst case, this can lead to remote code execution (RCE) on the server. The attack requires the victim to have an active backend session and to be deceived into clicking a malicious link, typically via email or a compromised website. The vulnerability is exacerbated when the security.backend.enforceReferrer feature is disabled and the BE/cookieSameSite configuration is set to lax or none. The CVSS score is 7.5 (High), and the EPSS probability is 0.0%, indicating low exploitation likelihood at the time of analysis. Patches are available in TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS.

Supply Chain & Package Security

This vulnerability is specific to the TYPO3 CMS ecosystem, which is a PHP-based content management framework. The attack vector involves the Extension Manager Module, which is a core component of TYPO3. Exploitation could lead to the installation of malicious third-party extensions from the TYPO3 Extension Repository, effectively compromising the supply chain of the CMS. Organizations using TYPO3 should treat this as a high-priority supply chain risk, as a compromised extension could introduce backdoors, data exfiltration, or further lateral movement within the network.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
• Attack Vector (AV): Network – The attack is executed over the network.
• Attack Complexity (AC): Low – No special conditions are required for exploitation.
• Privileges Required (PR): None – The attacker does not need prior authentication.
• User Interaction (UI): Required – The victim must click a malicious link.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High – Potential for full data exposure.
• Integrity (I): High – Potential for full system compromise.
• Availability (A): High – Potential for denial of service or system takeover.

Threat Level: High. The combination of network-based attack, low complexity, and potential for RCE makes this a critical vulnerability for TYPO3 deployments.

Deep Dive & Mechanics

The vulnerability resides in the backend user interface's deep link handling. TYPO3 uses deep links to navigate to specific backend modules. The deep link functionality does not properly validate the origin of requests, making it susceptible to CSRF. Additionally, state-changing actions in downstream components, such as the Extension Manager Module, incorrectly accept submissions via HTTP GET requests and do not enforce the appropriate HTTP method (e.g., POST). This allows an attacker to craft a malicious URL that, when clicked by an authenticated backend user, triggers actions like installing extensions.

The attack chain is as follows:

1. The attacker crafts a malicious URL that targets the TYPO3 backend, specifically the Extension Manager Module.
2. The URL is sent to the victim (e.g., via email) or hosted on a compromised website.
3. The victim, who has an active backend session, clicks the link.
4. The victim's browser sends a GET request to the TYPO3 backend, which is incorrectly processed as a state-changing action.
5. The Extension Manager Module retrieves and installs a third-party extension from the TYPO3 Extension Repository.
6. If the extension contains malicious code, the attacker achieves remote code execution.

The vulnerability is more easily exploitable when:

• security.backend.enforceReferrer is disabled (default is enabled, but may be disabled for compatibility).
• BE/cookieSameSite is set to lax or none (default is strict).

Vulnerable vs. Patched Code

The patch addresses the CSRF vulnerability by:

• Adding CSRF token validation to deep link requests.
• Enforcing HTTP method restrictions (e.g., requiring POST for state-changing actions).
• Ensuring that the Referer header is validated when enforceReferrer is enabled.

Vulnerable Code (Conceptual):

// In a vulnerable version, the deep link handler does not check for CSRF tokens.
class BackendDeepLinkHandler {
    public function processRequest($request) {
        $action = $request->getParameter('action');
        // No CSRF check
        $this->executeAction($action);
    }
}

Patched Code (Conceptual):

// In the patched version, CSRF token validation is added.
class BackendDeepLinkHandler {
    public function processRequest($request) {
        $action = $request->getParameter('action');
        // Validate CSRF token
        if (!$this->validateCsrfToken($request)) {
            throw new \TYPO3\CMS\Core\Exception('Invalid CSRF token');
        }
        // Enforce HTTP method
        if ($request->getMethod() !== 'POST') {
            throw new \TYPO3\CMS\Core\Exception('Invalid HTTP method');
        }
        $this->executeAction($action);
    }
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A TYPO3 instance running a vulnerable version (e.g., 11.5.41 ELTS).
• An authenticated backend user session.
• The victim must click a malicious link.

Exploitation Steps:

1. Identify a vulnerable TYPO3 backend URL (e.g., https://target.com/typo3/).
2. Craft a malicious URL that triggers the Extension Manager to install a malicious extension. Example:

   https://target.com/typo3/module/tools/Extensionmanager?tx_extensionmanager_tools_extensionmanagerextensionmanager%5Baction%5D=installExtension&tx_extensionmanager_tools_extensionmanagerextensionmanager%5BextensionKey%5D=malicious_extension
   

3. Host the malicious extension on the TYPO3 Extension Repository or a custom repository.
4. Send the URL to the victim via email or social engineering.
5. When the victim clicks the link, the extension is installed, and the attacker gains code execution.

Example Payload (URL):

https://target.com/typo3/module/tools/Extensionmanager?tx_extensionmanager_tools_extensionmanagerextensionmanager%5Baction%5D=installExtension&tx_extensionmanager_tools_extensionmanagerextensionmanager%5BextensionKey%5D=malicious_extension

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor backend logs for unusual GET requests to the Extension Manager Module.
2. Check for unexpected extension installations in the TYPO3 Extension Manager.
3. Verify that security.backend.enforceReferrer is enabled.
4. Ensure BE/cookieSameSite is set to strict.
5. Implement CSRF tokens for all backend actions.

Hunting Query (Splunk):

index=typo3 sourcetype=access_combined
| search uri="/typo3/module/tools/Extensionmanager*"
| stats count by src_ip, uri, method
| where method="GET"

Indicators of Compromise (IOCs)

• Network IOCs:
  • GET requests to /typo3/module/tools/Extensionmanager with parameters like action=installExtension.
  • Outbound connections to the TYPO3 Extension Repository or custom repositories for extension downloads.
• File IOCs:
  • Unexpected extension files in typo3conf/ext/ directory.
  • New PHP files in the web root or extension directories.
• System IOCs:
  • Unusual processes or cron jobs initiated by the web server user.
  • New user accounts or modified system files.

Detection Engineering

YARA Rule

rule CVE_2024_55921_CSRF_TYPO3 {
    meta:
        description = "Detects exploitation attempts of CVE-2024-55921 in TYPO3 backend logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55921"
    strings:
        $s1 = "tx_extensionmanager_tools_extensionmanagerextensionmanager%5Baction%5D=installExtension"
        $s2 = "tx_extensionmanager_tools_extensionmanagerextensionmanager%5BextensionKey%5D="
        $s3 = "/typo3/module/tools/Extensionmanager"
    condition:
        any of ($s*) and #s3 > 0
}

Sigma Rule

title: CVE-2024-55921 TYPO3 CSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to TYPO3 Extension Manager that may indicate CSRF exploitation
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - "tx_extensionmanager_tools_extensionmanagerextensionmanager%5Baction%5D=installExtension"
            - "tx_extensionmanager_tools_extensionmanagerextensionmanager%5BextensionKey%5D="
    condition: selection
falsepositives:
    - Legitimate extension installations via GET (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55921 TYPO3 CSRF Exploitation Attempt"; flow:to_server; content:"GET"; http_method; content:"/typo3/module/tools/Extensionmanager"; http_uri; content:"tx_extensionmanager_tools_extensionmanagerextensionmanager%5Baction%5D=installExtension"; http_uri; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3 to versions 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS.
2. Enable security.backend.enforceReferrer in the TYPO3 configuration.
3. Set BE/cookieSameSite to strict.
4. Review and remove any suspicious extensions installed recently.

Long-term Mitigations:

• Implement Web Application Firewall (WAF) rules to block CSRF-like requests.
• Enforce strict HTTP method validation for all state-changing actions.
• Conduct regular security audits of TYPO3 configurations.
• Educate backend users about phishing and social engineering risks.

Workaround (if patching is not immediately possible):

• Disable the Extension Manager Module for non-admin users.
• Restrict access to the TYPO3 backend via IP whitelisting or VPN.
• Monitor backend logs for anomalous GET requests.

Valters IT