CVE-2025-48202

Executive Summary

CVE-2025-48202 is an Insecure Direct Object Reference (IDOR) vulnerability in the TYPO3 extension femanager (versions up to and including 8.2.1). This flaw allows an unauthenticated attacker to access or manipulate objects (e.g., user profiles, records) by directly modifying a reference identifier in a request, without proper authorization checks. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood in the wild. No public proof-of-concept or exploit code is currently available.

Supply Chain & Package Security

This vulnerability affects the TYPO3 ecosystem via the femanager extension, which is distributed through the TYPO3 Extension Repository (TER). As a third-party extension, it introduces supply chain risk. Administrators should verify the integrity of the extension package and monitor for updates from the vendor.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the low complexity and no required privileges, but the impact is limited to low confidentiality loss.

Deep Dive & Mechanics

The vulnerability resides in the femanager extension's handling of object references. The extension fails to verify that the requesting user is authorized to access the referenced object (e.g., a user profile or record). An attacker can enumerate or manipulate object IDs (e.g., ?tx_femanager_pi1[user]=123) to access data belonging to other users.

Root Cause: The extension does not implement proper access control checks before returning or modifying objects based on user-supplied identifiers.

Attack Scenario:

1. An attacker identifies a TYPO3 site using femanager 8.2.1 or earlier.
2. The attacker sends a GET request to a vulnerable endpoint, modifying the object ID parameter.
3. The server returns the object data (e.g., user email, address) without verifying ownership.

Vulnerable vs. Patched Code

Vulnerable Code (femanager <= 8.2.1):

// No ownership check
public function showAction($user = null) {
    if ($user === null) {
        $user = $this->userRepository->findByUid($this->request->getArgument('user'));
    }
    $this->view->assign('user', $user);
}

Patched Code (Hypothetical fix):

public function showAction($user = null) {
    if ($user === null) {
        $user = $this->userRepository->findByUid($this->request->getArgument('user'));
    }
    // Verify ownership
    if ($user && $user->getUid() !== $this->getFrontendUser()->getUid()) {
        throw new \TYPO3\CMS\Extbase\Mvc\Exception\UnsupportedRequestTypeException('Access denied', 1580000000);
    }
    $this->view->assign('user', $user);
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install TYPO3 11.5.x with femanager 8.2.1.
2. Create two test users: user1 (UID 1) and user2 (UID 2).
3. Log in as user1 and obtain a session cookie.

Exploitation Steps:

1. Intercept a request to the profile page (e.g., ?tx_femanager_pi1[action]=show&tx_femanager_pi1[user]=1).
2. Modify the user parameter to 2 and forward the request.
3. Observe that the response contains user2's data (e.g., email, address).

Example Request:

GET /index.php?id=42&tx_femanager_pi1[action]=show&tx_femanager_pi1[user]=2 HTTP/1.1
Host: target-typo3-site.com
Cookie: fe_typo_user=abc123

Blue Team

Detection:

• Monitor for requests with sequential or unusual user parameter values.
• Log failed access attempts to unauthorized objects.
• Use Web Application Firewall (WAF) rules to block parameter tampering.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| rex field=uri "tx_femanager_pi1\[user\]=(?<uid>\d+)"
| stats count by uid, src_ip
| where count > 10

Indicators of Compromise (IOCs)

• Network: HTTP requests with multiple tx_femanager_pi1[user] parameters in a short time.
• Logs: TYPO3 system log entries showing Access denied or UnsupportedRequestTypeException for femanager actions.
• File: Modified ext_localconf.php or ext_tables.php in typo3conf/ext/femanager/.

Detection Engineering

YARA Rule

rule femanager_idor_exploit {
    meta:
        description = "Detects IDOR exploitation attempts against TYPO3 femanager extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48202"
    strings:
        $param = "tx_femanager_pi1[user]="
        $action = "action=show"
    condition:
        all of them
}

Sigma Rule

title: TYPO3 femanager IDOR Exploitation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-48202 by manipulating user parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'tx_femanager_pi1[user]='
    condition: selection
falsepositives:
    - Legitimate user profile access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48202 TYPO3 femanager IDOR Attempt"; flow:to_server,established; content:"GET"; http_method; content:"tx_femanager_pi1[user]="; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable or remove the femanager extension if not critical.
2. Short-term: Implement a WAF rule to block requests with suspicious user parameter values.
3. Long-term: Apply the hypothetical patch above or wait for an official update from the vendor.
4. Compensating Controls: Enforce strict access control checks at the application level using TYPO3's built-in authorization mechanisms.

Valters IT
DevSecOps & Cyber Threat Intelligence