CVE-2024-55922

Executive Summary

CVE-2024-55922 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 backend user interface, specifically affecting the deep linking functionality and the Form Framework Module. The vulnerability allows an attacker to manipulate or delete persisted form definitions by tricking an authenticated backend user into clicking a malicious link. The attack requires the victim to have an active backend session and for certain security configurations to be misconfigured (security.backend.enforceReferrer disabled and BE/cookieSameSite set to lax or none). The CVSS score is 5.4 (Medium), and while no public exploit code exists, the attack vector is straightforward and relies on social engineering. The vendor has released patched versions.

Supply Chain & Package Security

This vulnerability affects the TYPO3 Content Management Framework, which is a PHP-based open-source project. The vulnerability is in the core backend UI and the Form Framework Module, which is a standard component. There is no indication of a supply chain compromise; the issue is a code-level CSRF vulnerability in the official TYPO3 distribution. Users should verify the integrity of their TYPO3 installation after patching.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
• Attack Vector (AV): Network - The attack is carried out over the network.
• Attack Complexity (AC): Low - No special conditions are required.
• Privileges Required (PR): None - The attacker does not need to be authenticated.
• User Interaction (UI): Required - The victim must click a malicious link.
• Scope (S): Unchanged - The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): None - No data is exposed.
• Integrity (I): Low - The attacker can modify or delete form definitions.
• Availability (A): Low - The attacker can delete form definitions, impacting availability of those forms.

Threat Level: Medium. The attack requires user interaction and specific misconfigurations, but the impact on integrity and availability is tangible. The lack of public exploit code reduces immediate risk, but the vulnerability is easily exploitable once the conditions are met.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3 backend user interface's deep linking functionality. Deep links are used to navigate directly to specific backend modules or records. The core issue is twofold:

1. CSRF in Deep Linking: The deep linking mechanism does not properly validate the origin of requests. An attacker can craft a URL that, when clicked by an authenticated backend user, performs state-changing actions without the user's consent.
2. Incorrect HTTP Method Enforcement: Downstream components, particularly the Form Framework Module, accept state-changing actions via HTTP GET requests instead of requiring POST, PUT, or DELETE. This makes CSRF attacks trivial because a simple <img> tag or a link can trigger the action.

The attack flow:

1. The attacker identifies a TYPO3 instance with the vulnerable configurations (enforceReferrer disabled, cookieSameSite set to lax or none).
2. The attacker crafts a malicious URL that targets the Form Framework Module's action to delete or modify a form definition. The URL might look like: https://target.tld/typo3/module/web/FormFormFramework?action=delete&form=123.
3. The attacker sends this URL to a victim who has an active backend session (e.g., via email or a compromised website).
4. The victim clicks the link, and the browser sends the request with the victim's session cookie.
5. The TYPO3 backend processes the GET request and performs the state-changing action (e.g., deleting form definition ID 123).

The vulnerability is classified as CWE-352 (Cross-Site Request Forgery).

Vulnerable vs. Patched Code

The patch addresses the vulnerability by:

1. Adding CSRF token validation to the deep linking functionality.
2. Enforcing proper HTTP methods (POST, PUT, DELETE) for state-changing actions in the Form Framework Module.

Vulnerable Code (Conceptual):

// In a vulnerable controller action (e.g., deleteAction)
public function deleteAction($formId) {
    // No CSRF token check
    // No HTTP method check
    $this->formRepository->delete($formId);
    // ...
}

Patched Code (Conceptual):

// In a patched controller action
public function deleteAction($formId) {
    // Check HTTP method
    if (!$this->request->isMethod('POST')) {
        throw new \TYPO3\CMS\Core\Http\ImmediateResponseException(
            new \TYPO3\CMS\Core\Http\Response('Method Not Allowed', 405)
        );
    }
    // Validate CSRF token
    if (!$this->security->validateToken($this->request->getParsedBody()['__csrfToken'])) {
        throw new \TYPO3\CMS\Core\Http\ImmediateResponseException(
            new \TYPO3\CMS\Core\Http\Response('Invalid CSRF Token', 403)
        );
    }
    $this->formRepository->delete($formId);
    // ...
}

The actual patch involves changes to the core backend routing and the Form Framework Module. The specific commit details are not publicly available, but the fix is included in the mentioned patched versions.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TYPO3 instance with version < 11.5.42 ELTS, < 12.4.25 LTS, or < 13.4.3 LTS.
• The security.backend.enforceReferrer setting is disabled.
• The BE/cookieSameSite setting is set to lax or none.
• A valid backend user session (the victim must be logged in).

Exploitation Steps:

1. Identify Target: Use Shodan or manual browsing to find TYPO3 instances. Check the backend URL (e.g., /typo3/).
2. Craft Malicious URL: Determine the Form Framework Module's endpoint. A typical URL to delete a form might be:

   http://target.tld/typo3/module/web/FormFormFramework?action=delete&form=1
   

   To modify a form, you might use:

   http://target.tld/typo3/module/web/FormFormFramework?action=save&form=1&data=malicious_data
   

3. Deliver Payload: Send the URL to the victim via email, a link on a compromised site, or a social engineering campaign.
4. Execute: When the victim clicks the link, the action is performed.

Example HTML Payload (for email or web page):

<a href="http://target.tld/typo3/module/web/FormFormFramework?action=delete&form=1">Click here for a free gift!</a>

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual GET requests to backend modules, especially those with action=delete, action=save, or similar parameters.
• Look for requests to /typo3/module/web/FormFormFramework with unexpected parameters.
• Analyze web server logs for patterns of CSRF attacks (e.g., multiple requests from different IPs to the same action).

Defense:

• Immediate: Upgrade to the patched versions (11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS).
• Configuration: Ensure security.backend.enforceReferrer is enabled and BE/cookieSameSite is set to strict.
• Web Application Firewall (WAF): Create rules to block GET requests to backend modules that perform state-changing actions.
• User Training: Educate backend users about phishing attacks and the risks of clicking suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests to /typo3/module/web/FormFormFramework with parameters like action=delete, action=save, action=duplicate.
  • Referer header missing or unexpected for backend requests.
  • Multiple requests to the same backend action from different IPs in a short time.
• File System IOCs:
  • Unexpected changes or deletions in the form_definitions storage (typically in fileadmin or database).
• Log IOCs:
  • Web server logs showing GET /typo3/module/web/FormFormFramework?action=delete&form=... with a 200 response.
  • TYPO3 system logs showing FormDefinitionDeleted or similar events without a corresponding POST request.

Detection Engineering

YARA Rule

rule Detect_CVE_2024_55922_CSRF_Exploit {
    meta:
        description = "Detects HTTP GET requests targeting TYPO3 Form Framework Module with state-changing actions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55922"
    strings:
        $s1 = "/typo3/module/web/FormFormFramework" ascii wide nocase
        $s2 = "action=delete" ascii wide nocase
        $s3 = "action=save" ascii wide nocase
        $s4 = "action=duplicate" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2024-55922 TYPO3 Backend CSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP GET requests to TYPO3 Form Framework Module with state-changing actions, indicating possible CSRF exploitation.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-55922
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains:
            - "/typo3/module/web/FormFormFramework"
            - "action=delete"
            - "action=save"
            - "action=duplicate"
    condition: selection
falsepositives:
    - Legitimate backend operations (rare, as these should use POST)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-55922 TYPO3 Backend CSRF Exploit"; flow:to_server; http.method; content:"GET"; http.uri; content:"/typo3/module/web/FormFormFramework"; http.uri; content:"action=delete" or content:"action=save" or content:"action=duplicate"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade TYPO3 to version 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS immediately.
2. Configuration Hardening:
   • Enable security.backend.enforceReferrer in typo3conf/LocalConfiguration.php:

     'security' => [
         'backend' => [
             'enforceReferrer' => true,
         ],
     ],
     

   • Set BE/cookieSameSite to strict:

     'BE' => [
         'cookieSameSite' => 'strict',
     ],
     

Long-Term Mitigations:

• Implement a Web Application Firewall (WAF) with rules to block GET requests to backend modules.
• Regularly review and update TYPO3 security configurations.
• Conduct security awareness training for backend users.
• Monitor for unusual backend activity.

Workarounds: No known workarounds exist. Patching is the only reliable fix.

Valters IT