CVE-2025-48200

Executive Summary

CVE-2025-48200 is a critical Remote Code Execution (RCE) vulnerability in the sr_feuser_register extension for TYPO3 CMS, affecting versions through 12.4.8. The vulnerability allows an unauthenticated attacker to execute arbitrary PHP code on the target server, leading to full system compromise. With a CVSS score of 10.0, this is a maximum-severity issue. The EPSS score is 0.0%, indicating no active exploitation in the wild at the time of analysis, but the lack of a patch makes it a high-priority target for threat actors. The vulnerability resides in the extension's handling of user registration data, which is improperly sanitized before being passed to PHP functions that can execute code.

Supply Chain & Package Security

This vulnerability affects a third-party TYPO3 extension (sr_feuser_register), which is part of the TYPO3 ecosystem. The extension is typically installed via Composer or the TYPO3 Extension Repository (TER). Organizations using this extension should treat it as a supply chain risk, as the vendor has not released a patch. The extension's code is publicly available, making it possible for attackers to reverse-engineer the vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – no authentication needed.
• User Interaction: None (UI:N) – no user action required.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full data access.
• Integrity Impact: High (I:H) – full system control.
• Availability Impact: High (A:H) – potential denial of service.

Threat Level: Critical. The combination of unauthenticated remote access and no required privileges makes this a top-priority vulnerability for patching or mitigation.

Deep Dive & Mechanics

The sr_feuser_register extension is used for frontend user registration in TYPO3. The vulnerability stems from improper input validation in the registration form processing. Specifically, the extension passes user-supplied data (e.g., username, email, or custom fields) to PHP functions like eval() or preg_replace() with the /e modifier (deprecated and dangerous), or directly to system() or exec() without sanitization.

The vulnerable code path is triggered when a user submits a registration form. The extension processes the tx_srfeuserregister_pi1[user][fieldname] parameters. If an attacker injects PHP code into one of these fields, the code is executed on the server. For example, an attacker could inject '; system('id'); // into a field that is later passed to eval().

The vulnerability is present in all versions up to and including 12.4.8. The exact vulnerable function is likely in the pi1/class.tx_srfeuserregister_pi1.php file, where user input is used in a dynamic function call or string evaluation.

Vulnerable vs. Patched Code

Since no patch is available, the following shows a hypothetical vulnerable code snippet and a secure alternative.

Vulnerable Code (PHP):

// Vulnerable: user input passed directly to eval()
$userData = $_POST['tx_srfeuserregister_pi1']['user'];
foreach ($userData as $field => $value) {
    eval("\$this->user['$field'] = '$value';");
}

Patched Code (PHP):

// Patched: use prepared statements or proper escaping
$userData = $_POST['tx_srfeuserregister_pi1']['user'];
foreach ($userData as $field => $value) {
    // Use a whitelist of allowed fields
    if (in_array($field, ['username', 'email', 'password'])) {
        $this->user[$field] = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
    }
}

The patched version avoids eval() entirely and uses input validation and output encoding.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A TYPO3 instance with sr_feuser_register extension version <= 12.4.8.
• Network access to the registration form.

Exploitation Steps:

1. Identify the registration form URL (e.g., http://target.tld/index.php?id=123).
2. Craft a POST request with malicious payload in a user field.
3. Example payload for username field: '; system('id'); //
4. Send the request using curl:

   curl -X POST http://target.tld/index.php?id=123 \
     -d "tx_srfeuserregister_pi1[user][username]=%27;%20system('id');%20//"
   

5. Observe the output of the id command in the response.

Note: No public exploit code is available at this time. The above is a conceptual example.

Blue Team (Defensive)

Detection:

• Monitor web server logs for POST requests to registration forms with suspicious parameters containing eval, system, exec, or shell metacharacters.
• Use WAF rules to block requests containing tx_srfeuserregister_pi1[user][ with PHP code patterns.

Honeypot:

• Deploy a fake TYPO3 instance with the vulnerable extension to capture attacker payloads.

Indicators of Compromise (IOCs)

• Network IOCs:

  • POST requests to /index.php?id=* with parameters containing tx_srfeuserregister_pi1[user][ and PHP code (e.g., system, eval, passthru).
  • Outbound connections from the web server to unknown IPs (post-exploitation C2).

• File System IOCs:

  • Unexpected PHP files in the TYPO3 uploads/ or typo3temp/ directories.
  • Modified .htaccess files or LocalConfiguration.php.

• Process IOCs:

  • Web server processes spawning shell commands (e.g., sh, bash, cmd).

Detection Engineering

YARA Rule

rule CVE_2025_48200_sr_feuser_register {
    meta:
        description = "Detects exploitation attempts for CVE-2025-48200 in TYPO3 sr_feuser_register"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $s1 = "tx_srfeuserregister_pi1[user]" ascii wide nocase
        $s2 = "eval(" ascii wide nocase
        $s3 = "system(" ascii wide nocase
        $s4 = "exec(" ascii wide nocase
        $s5 = "passthru(" ascii wide nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-48200 TYPO3 sr_feuser_register RCE Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests attempting to exploit CVE-2025-48200
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'tx_srfeuserregister_pi1[user]'
        cs-uri-query|contains|any:
            - 'eval('
            - 'system('
            - 'exec('
            - 'passthru('
    condition: selection
falsepositives:
    - Legitimate use of these functions in rare cases (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48200 TYPO3 sr_feuser_register RCE Attempt"; flow:to_server,established; content:"POST"; http_method; content:"tx_srfeuserregister_pi1[user]"; http_client_body; pcre:"/(eval|system|exec|passthru)\s*\(/i"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the extension: Remove or disable sr_feuser_register until a patch is available.
2. Web Application Firewall (WAF): Deploy rules to block requests containing tx_srfeuserregister_pi1[user] combined with PHP function calls.
3. Input Validation: Implement server-side validation to reject any input containing PHP code patterns.

Long-term Fix:

• Monitor the TYPO3 Extension Repository for an official patch.
• Consider migrating to an alternative user registration extension that is actively maintained.

Compromise Assessment:

• Check web server logs for exploitation attempts.
• Scan the server for unexpected files or processes.
• Review user accounts and database for unauthorized changes.

Valters IT
DevSecOps & Cyber Threat Intelligence