CVE-2025-47938

Executive Summary

CVE-2025-47938 is a security advisory affecting the TYPO3 content management system (CMS), an open-source, PHP-based web application. The vulnerability resides in the backend user management interface, where password changes can be performed without requiring the current password for verification. This flaw lowers the barrier for unauthorized account takeover in scenarios where an administrator session is hijacked or left unattended. The vulnerability impacts all TYPO3 versions from 9.0.0 up to, but not including, the patched releases. The CVSS score is 3.8 (Low), reflecting the requirement for high privileges and user interaction, but the impact on confidentiality, integrity, and availability is limited. No public proof-of-concept (PoC) or exploit code is currently available.

Supply Chain & Package Security

TYPO3 is a PHP-based CMS distributed as a Composer package. The vulnerability exists in the core backend code, not in a third-party extension. Organizations using TYPO3 should verify their version and apply the patch immediately. The lack of a current password check during password changes is a design flaw that weakens session security.

CVSS Breakdown & Threat Level

• CVSS Score: 3.8 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:N/I:L/A:L
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): High (H) – An attacker must have an active admin session.
• User Interaction (UI): Required (R) – The admin must be logged in and perform the password change.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): None (N) – No direct data exposure.
• Integrity (I): Low (L) – An attacker can change passwords, affecting account integrity.
• Availability (A): Low (L) – An attacker could lock out legitimate users by changing passwords.

Threat Level: Low. Exploitation requires an active admin session, which limits the attack surface. However, in shared or unattended environments, the risk is elevated.

Deep Dive & Mechanics

The vulnerability is a classic case of Missing Authentication for Critical Function (CWE-306) . In the TYPO3 backend user management module, the password change functionality does not enforce re-authentication by requiring the current password. This is a security best practice to prevent session hijacking or unattended terminal attacks.

Technical Flow:

1. An administrator logs into the TYPO3 backend.
2. The admin navigates to the user management interface (e.g., "Backend Users" module).
3. The admin selects a user account (including their own) and initiates a password change.
4. The form submits the new password without checking the current password.
5. The backend processes the request and updates the password hash in the database.

Root Cause: The password change form lacks a field for the current password, and the server-side validation does not verify the old password before accepting the new one.

Impact: An attacker who gains access to an admin session (via session hijacking, XSS, or physical access) can change the password of any user, including the admin themselves, leading to account takeover and potential privilege escalation.

Vulnerable vs. Patched Code

The vulnerable code is in the TYPO3 backend user management controller. The patched version adds a check for the current password.

Vulnerable Code (Simplified PHP):

// In UserManagementController.php
public function updateUserAction(User $user, string $newPassword): void
{
    // No check for current password
    $user->setPassword($this->hashPassword($newPassword));
    $this->userRepository->update($user);
}

Patched Code (Simplified PHP):

// In UserManagementController.php
public function updateUserAction(User $user, string $currentPassword, string $newPassword): void
{
    // Verify current password
    if (!$this->passwordService->verifyPassword($user, $currentPassword)) {
        throw new \TYPO3\CMS\Core\Exception('Current password is incorrect.');
    }
    $user->setPassword($this->hashPassword($newPassword));
    $this->userRepository->update($user);
}

The patch adds a $currentPassword parameter and a verification step using PasswordService::verifyPassword(). The frontend form must also include a field for the current password.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Access to an active TYPO3 backend admin session (e.g., via session cookie theft or physical access).
• The target TYPO3 version must be vulnerable (9.0.0 to 9.5.50, 10.0.0 to 10.4.49, etc.).

Exploitation Steps:

1. Obtain an admin session cookie (e.g., be_typo_user).
2. Navigate to the backend user management module (e.g., /typo3/module/system/BeUsers).
3. Select a target user (e.g., the admin account).
4. Submit a password change request with a new password of your choice.
5. The password is updated without any verification.
6. Log out and log in with the new password to confirm takeover.

No public exploit code is available. The attack is manual and requires session access.

Blue Team (Defense & Detection)

Detection:

• Monitor for password change events in TYPO3 logs (typo3/logs/typo3.log).
• Look for multiple password changes in a short time frame.
• Alert on password changes performed from unusual IP addresses or user agents.

Prevention:

• Apply the patch immediately.
• Enforce session timeouts and inactivity locks.
• Use multi-factor authentication (MFA) for admin accounts.
• Monitor for session hijacking indicators (e.g., unusual geographic locations).

Indicators of Compromise (IOCs)

• Log Entry: Password changed for user [username] without a corresponding Current password verified entry.
• Session Anomaly: Admin session used from an unexpected IP address or device.
• User Account Changes: Multiple password changes in a short period.
• File Integrity: Modified user records in the be_users database table.

Detection Engineering

YARA Rule

rule CVE_2025_47938_TYPO3_Password_Change
{
    meta:
        description = "Detects TYPO3 password change without current password verification"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-47938"
    strings:
        $s1 = "updateUserAction" nocase
        $s2 = "setPassword" nocase
        $s3 = "userRepository->update" nocase
        $s4 = "currentPassword" nocase
    condition:
        all of ($s1, $s2, $s3) and not $s4
}

Sigma Rule

title: TYPO3 Password Change Without Current Password Verification
id: 8f7b3c2a-1d5e-4f6a-9b8c-0d1e2f3a4b5c
status: experimental
description: Detects password change events in TYPO3 logs that lack current password verification.
author: Valters IT
date: 2025-04-10
logsource:
    product: typo3
    service: backend
detection:
    selection:
        EventID: 'password_change'
    filter:
        - 'current_password_verified: true'
    condition: selection and not filter
falsepositives:
    - Legitimate password changes after patch
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-47938 TYPO3 Password Change Without Verification"; flow:to_server,established; content:"POST"; http_method; content:"/typo3/module/system/BeUsers"; http_uri; content:"tx_beuser_action[updateUser]"; http_client_body; pcre:"/newPassword=[^&]+/"; pcre:"!/currentPassword=/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade to TYPO3 version 9.5.51 ELTS, 10.4.50 ELTS, 11.5.44 ELTS, 12.4.31 LTS, or 13.4.12 LTS.
2. Workaround: If patching is not possible, restrict access to the backend user management module via IP whitelisting or VPN.
3. Session Security: Enforce session timeouts (e.g., 15 minutes) and implement inactivity locks.

Long-Term Measures:

• Implement multi-factor authentication (MFA) for all admin accounts.
• Conduct regular security audits of TYPO3 configurations.
• Monitor logs for anomalous password changes.
• Use a Web Application Firewall (WAF) to detect and block exploitation attempts.

Valters IT – Securing digital ecosystems through proactive threat intelligence.