CVE-2025-47937

Executive Summary

CVE-2025-47937 is a vulnerability in the TYPO3 content management system (CMS) affecting the database abstraction layer (DBAL). When performing database queries that involve multiple tables, the FrontendGroupRestriction permission check is only applied to the first table in the query. This oversight can lead to unauthorized exposure of data from subsequent tables to frontend users who should not have access.

The vulnerability has a low CVSS score of 3.7 due to the requirement of a specific query pattern and the limited scope of data exposure. However, in complex TYPO3 installations with custom extensions or complex content structures, the impact could be more severe. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis.

Supply Chain & Package Security

TYPO3 is a PHP-based CMS distributed as a Composer package. The vulnerability exists in the core DBAL component, which is a fundamental part of the TYPO3 framework. Organizations using TYPO3 should verify their dependency tree and ensure that the core package (typo3/cms-core) is updated to a patched version. Third-party extensions that rely on multi-table queries through the DBAL may also be affected.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): None (N) - An unauthenticated user can trigger the vulnerability.
• User Interaction (UI): None (N) - No user action is required.
• Scope (S): Unchanged (U) - The impact is confined to the vulnerable component.
• Confidentiality (C): Low (L) - Limited data exposure from additional tables.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service impact.

Threat Level: Low. The vulnerability requires a specific query pattern (multiple tables) and only exposes data from secondary tables. However, in environments with sensitive data in related tables, the risk is elevated.

Deep Dive & Mechanics

The vulnerability resides in the TYPO3 DBAL, specifically in how FrontendGroupRestriction is applied to database queries. When a query involves multiple tables (e.g., a JOIN), the restriction is only applied to the first table in the FROM clause. This means that data from subsequent tables is not filtered based on frontend user group permissions.

Root Cause: The FrontendGroupRestriction is implemented as a query modifier that adds WHERE clauses to restrict access based on user group membership. However, the implementation only processes the first table in the query, leaving other tables unrestricted.

Attack Vector: An attacker can craft a request that triggers a multi-table query through the TYPO3 frontend. This could be achieved through:

• Custom extensions that perform JOIN queries.
• TYPO3's built-in content rendering that uses relations (e.g., content elements with file references).
• API endpoints that expose data from multiple tables.

Impact: Unauthorized users can access data from tables that should be restricted. For example:

• A frontend user could see content from a table that is only intended for admin users.
• Sensitive metadata or configuration data stored in related tables could be exposed.

Vulnerable vs. Patched Code

The fix involves modifying the FrontendGroupRestriction implementation to apply the restriction to all tables in a query, not just the first one.

Vulnerable Code (Conceptual):

// In the query building process
$queryBuilder = $this->createQueryBuilder();
$queryBuilder
    ->select('*')
    ->from('tt_content', 'c')
    ->join('c', 'pages', 'p', 'c.pid = p.uid');

// FrontendGroupRestriction is only applied to 'tt_content'
$restriction = GeneralUtility::makeInstance(FrontendGroupRestriction::class);
$restriction->buildExpression(['tt_content' => 'c'], $queryBuilder);

Patched Code (Conceptual):

// In the query building process
$queryBuilder = $this->createQueryBuilder();
$queryBuilder
    ->select('*')
    ->from('tt_content', 'c')
    ->join('c', 'pages', 'p', 'c.pid = p.uid');

// FrontendGroupRestriction is now applied to all tables
$restriction = GeneralUtility::makeInstance(FrontendGroupRestriction::class);
$restriction->buildExpression(['tt_content' => 'c', 'pages' => 'p'], $queryBuilder);

The actual patch modifies the restriction container to iterate over all tables in the query and apply the restriction to each one.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TYPO3 instance with version 9.0.0 to 13.4.11.
• A content structure that uses relations between tables (e.g., content elements with file references or category associations).
• A frontend user with limited permissions.

Exploitation Steps:

1. Identify a TYPO3 endpoint that performs a multi-table query. This could be a custom extension or a built-in feature like the list view or content rendering.
2. Craft a request that triggers the query. For example, accessing a page that renders content elements with file references.
3. Observe the response for data from the secondary table that should be restricted.

Example Request (Conceptual):

GET /index.php?id=123&type=1234 HTTP/1.1
Host: vulnerable-typo3-instance.com

Expected Outcome: The response may contain data from the pages table (or other related tables) that the frontend user should not have access to.

Blue Team (Detection & Hardening)

Detection:

• Monitor database query logs for unexpected multi-table queries from frontend users.
• Look for anomalies in the data returned to frontend users, especially if it includes fields from restricted tables.

Hardening:

• Apply the patch immediately by upgrading to the patched versions.
• Review custom extensions for multi-table queries and ensure they apply restrictions correctly.
• Implement additional access controls at the application level for sensitive data.

Indicators of Compromise (IOCs)

• Network: Unusual HTTP requests to TYPOS endpoints that trigger multi-table queries.
• Logs: Database query logs showing JOIN operations without proper restrictions.
• Application: Frontend users accessing data from tables that should be restricted.

Specific IOCs:

• Database queries containing JOIN or LEFT JOIN clauses where the secondary table is not tt_content or pages.
• Error logs showing attempts to access restricted data.

Detection Engineering

YARA Rule

rule Detect_TYPO3_CVE_2025_47937_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-47937 in TYPO3"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47937"
    strings:
        $s1 = "FrontendGroupRestriction" nocase
        $s2 = "buildExpression" nocase
        $s3 = "->from(" nocase
        $s4 = "->join(" nocase
    condition:
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: TYPO3 CVE-2025-47937 Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2025-47937 in TYPO3
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        c-uri|contains:
            - 'index.php'
            - '?id='
    condition: selection
falsepositives:
    - Legitimate TYPO3 requests
level: low

Suricata Rule

alert http any any -> any any (msg:"TYPO3 CVE-2025-47937 Exploitation Attempt"; flow:to_server,established; content:"GET"; http_method; content:"index.php"; http_uri; content:"id="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3 to the patched version:

   • 9.5.51 ELTS
   • 10.4.50 ELTS
   • 11.5.44 ELTS
   • 12.4.31 LTS
   • 13.4.12 LTS

2. If immediate upgrade is not possible, review all custom extensions that perform multi-table queries and manually apply FrontendGroupRestriction to all tables.

Long-term Mitigations:

• Implement a Web Application Firewall (WAF) to monitor and block suspicious requests.
• Regularly audit TYPO3 extensions for security vulnerabilities.
• Follow the principle of least privilege for frontend user groups.

Workaround:

• Disable or restrict access to any custom extensions that perform multi-table queries until the patch is applied.

Valters IT