CVE-2025-48205

Executive Summary

CVE-2025-48205 is an Insecure Direct Object Reference (IDOR) vulnerability in the TYPO3 extension sr_feuser_register through version 12.4.8. This flaw allows an unauthenticated attacker to access or modify user registration data by manipulating object references (e.g., user IDs) in HTTP requests. The vulnerability has a CVSS score of 8.6 (High) and is currently unpatched. No public exploit code or Nuclei template is available, but the attack vector is straightforward and requires no authentication.

Supply Chain & Package Security

This vulnerability affects a third-party TYPO3 extension (sr_feuser_register), which is distributed via the TYPO3 Extension Repository (TER). The extension is not managed by the core TYPO3 team, and no official patch has been released. Organizations using this extension should treat it as a supply chain risk and consider replacing it with an alternative or implementing strict access controls.

CVSS Breakdown & Threat Level

• CVSS Score: 8.6 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high confidentiality impact stems from the ability to read arbitrary user registration data, including personal information and potentially authentication tokens.

Deep Dive & Mechanics

The sr_feuser_register extension handles frontend user registration and profile management. The IDOR vulnerability arises when the extension fails to verify that the requesting user owns the resource being accessed. For example, a GET request to /index.php?tx_srfeuserregister_pi1[user]=123 might return the profile data of user ID 123 without checking if the requester is that user or an administrator.

The vulnerability is rooted in the extension's controller logic, which directly uses user-supplied identifiers (e.g., tx_srfeuserregister_pi1[user]) to fetch records from the database without proper authorization checks. This allows an attacker to enumerate user IDs and extract sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Typical pattern in sr_feuser_register <= 12.4.8):

public function showAction() {
    $userUid = $this->request->getArgument('user');
    $user = $this->userRepository->findByUid($userUid);
    // No ownership check
    $this->view->assign('user', $user);
}

Patched Code (Hypothetical fix):

public function showAction() {
    $userUid = $this->request->getArgument('user');
    $currentUser = $this->getFrontendUser();
    if ($currentUser && $currentUser->getUid() === (int)$userUid) {
        $user = $this->userRepository->findByUid($userUid);
        $this->view->assign('user', $user);
    } else {
        throw new \TYPO3\CMS\Core\Exception('Access denied');
    }
}

The fix adds an ownership check to ensure the logged-in user can only access their own data.

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a TYPO3 instance with sr_feuser_register version 12.4.8 and create several test user accounts.
2. Reconnaissance: Enumerate user IDs by observing registration patterns or using common IDs (e.g., 1, 2, 3).
3. Exploit: Send a GET request to the vulnerable endpoint:

   GET /index.php?tx_srfeuserregister_pi1[user]=2 HTTP/1.1
   Host: target-typo3-site.com
   

4. Data Extraction: The response will contain the user's profile data (name, email, address, etc.) if the ID is valid.

Blue Team

1. Detection: Monitor for unusual patterns in access logs, such as sequential user ID requests to the sr_feuser_register plugin.
2. Mitigation: Implement a Web Application Firewall (WAF) rule to block requests with suspicious tx_srfeuserregister_pi1[user] parameters.
3. Harden: Disable the extension if not essential, or apply a custom patch to enforce ownership checks.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /index.php with parameter tx_srfeuserregister_pi1[user]=<integer> from unauthenticated sources.
• Logs: TYPO3 access logs showing repeated requests to the sr_feuser_register plugin with varying user IDs.
• File: Unusual access to fe_users table records via the extension's actions.

Detection Engineering

YARA Rule

rule CVE_2025_48205_IDOR_TYPO3 {
    meta:
        description = "Detects exploitation attempts of CVE-2025-48205 in TYPO3 sr_feuser_register"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-48205"
    strings:
        $param = "tx_srfeuserregister_pi1[user]="
        $path = "/index.php"
    condition:
        $path and $param
}

Sigma Rule

title: CVE-2025-48205 IDOR Exploitation Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit IDOR in TYPO3 sr_feuser_register
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'tx_srfeuserregister_pi1[user]='
    condition: selection
falsepositives:
    - Legitimate admin actions (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-48205 TYPO3 sr_feuser_register IDOR Attempt"; flow:to_server; http.uri; content:"/index.php"; http.uri; content:"tx_srfeuserregister_pi1[user]="; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the sr_feuser_register extension if not critical to business operations.
2. Short-term: Implement a custom patch to add ownership checks in the extension's controller (see patched code example).
3. Long-term: Replace the extension with a maintained alternative that follows secure coding practices.
4. Monitoring: Deploy the provided detection rules to identify exploitation attempts.
5. User Education: Inform users to change passwords if their data may have been exposed.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert