CVE-2025-57758

Executive Summary

CVE-2025-57758 is a missing authorization vulnerability in the Contao Open Source CMS, affecting versions 5.0.0 through 5.3.37 and 5.4.0 through 5.6.0. The vulnerability resides in the backend table access voter, which fails to verify whether a user has permission to access the corresponding module. This allows an authenticated attacker with low privileges to access backend tables they should not be able to see, potentially leading to unauthorized information disclosure. The CVSS score is 4.3 (Medium), and while no public exploit code exists, the attack vector is network-based and requires authentication. The vendor has released patches in versions 5.3.38 and 5.6.1.

Supply Chain & Package Security

Contao is a PHP-based CMS distributed via Composer. The vulnerability is in the core application code, not in a third-party package. However, organizations using Contao should verify their Composer dependencies are updated to the patched versions. The package is available on Packagist as contao/contao.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid backend user account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The exploit does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure is possible.
• Integrity (I): None (N) - No data modification is possible.
• Availability (A): None (N) - No denial of service impact.

Threat Level: Medium. The vulnerability requires authentication, limiting the attack surface to internal or compromised users. However, it can lead to unauthorized access to backend data.

Deep Dive & Mechanics

The Contao backend uses a voting system to authorize access to various resources, including database tables. The TableAccessVoter is responsible for determining if a user can access a specific table. The flaw is that this voter does not check the USER_CAN_ACCESS_MODULE permission, which is the gatekeeper for module-level access. As a result, a user with low privileges (e.g., a content editor) can directly access tables belonging to modules they are not authorized to use, such as system configuration or user management tables.

The vulnerability is triggered when an authenticated user makes a direct request to a backend route that accesses a table. The voter incorrectly grants access because it only checks table-level permissions without verifying the parent module permission. This bypasses the intended access control hierarchy.

Vulnerable vs. Patched Code

Vulnerable Code (Contao 5.3.37 and earlier):

// In TableAccessVoter.php
public function vote(TokenInterface $token, mixed $subject, array $attributes): int
{
    // ... checks table permissions but does NOT check module access
    if ($this->isTableAllowed($subject, $user)) {
        return self::ACCESS_GRANTED;
    }
    return self::ACCESS_DENIED;
}

Patched Code (Contao 5.3.38 and later):

// In TableAccessVoter.php
public function vote(TokenInterface $token, mixed $subject, array $attributes): int
{
    // Added module access check
    if (!$this->isModuleAllowed($subject, $user)) {
        return self::ACCESS_DENIED;
    }
    if ($this->isTableAllowed($subject, $user)) {
        return self::ACCESS_GRANTED;
    }
    return self::ACCESS_DENIED;
}

private function isModuleAllowed(mixed $subject, BackendUser $user): bool
{
    // Retrieve the module associated with the table
    $module = $this->getModuleForTable($subject);
    return $user->hasAccess($module, 'modules');
}

The patch adds a call to isModuleAllowed() which checks USER_CAN_ACCESS_MODULE before proceeding to table-level checks. This ensures that a user must have access to the parent module to access its tables.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Contao instance running version 5.0.0 to 5.3.37 or 5.4.0 to 5.6.0.
• A valid backend user account with low privileges (e.g., "Editor" role).

Exploitation Steps:

1. Log in to the Contao backend as a low-privileged user.
2. Identify a backend route that accesses a table from a restricted module (e.g., contao?do=user&table=tl_user).
3. Craft a direct HTTP request to that route.
4. Observe that the request succeeds, revealing data from the tl_user table (user accounts, passwords, etc.).

Example Request:

GET /contao?do=user&table=tl_user HTTP/1.1
Host: target-contao-instance.com
Cookie: contao_backend_session=VALID_SESSION_COOKIE

Expected Outcome: The attacker gains unauthorized access to the user management table, potentially exposing sensitive user data.

Blue Team

Detection:

• Monitor backend access logs for unusual table access patterns, especially from low-privileged users.
• Look for direct requests to tables that are not part of the user's assigned modules.
• Use the Sigma rule provided in the Detection Engineering section.

Hunting:

• Search for HTTP requests containing table= parameters that do not correspond to the user's role.
• Correlate backend user activity with module assignments.

Mitigation:

• Apply the patch immediately (upgrade to 5.3.38 or 5.6.1).
• As a workaround, implement additional checks in custom code using USER_CAN_ACCESS_MODULE.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /contao?do=*&table=* from low-privileged users.
  • Unusual access to tables like tl_user, tl_settings, tl_log by non-admin users.
• System IOCs:
  • Backend user activity logs showing access to unauthorized modules.
  • Unexpected changes to system configuration or user accounts.
• File IOCs:
  • Modified log files in var/logs/ indicating unauthorized access attempts.

Detection Engineering

YARA Rule

rule CVE_2025_57758_Contao_TableAccess {
    meta:
        description = "Detects exploitation attempts of CVE-2025-57758 in Contao CMS"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-57758"
    strings:
        $s1 = "contao?do="
        $s2 = "&table="
        $s3 = "tl_user"
        $s4 = "tl_settings"
        $s5 = "tl_log"
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: Contao CVE-2025-57758 Unauthorized Table Access
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects attempts to exploit missing authorization in Contao backend table access voter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "contao?do="
            - "&table="
    condition: selection
falsepositives:
    - Legitimate admin access to tables
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-57758 Contao Unauthorized Table Access"; flow:to_server,established; content:"contao?do="; http_uri; content:"&table="; http_uri; content:"tl_"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Contao to version 5.3.38 or 5.6.1 (or later).
2. If immediate upgrade is not possible, implement the workaround: in custom code, add explicit checks for USER_CAN_ACCESS_MODULE before accessing any backend table.

Long-Term Measures:

• Review and audit all backend user permissions regularly.
• Implement additional logging for backend table access.
• Use a Web Application Firewall (WAF) to block suspicious requests.
• Follow the principle of least privilege for all backend users.

Patch Verification:

• After upgrading, verify that the TableAccessVoter.php file contains the isModuleAllowed() method.
• Test by attempting to access a restricted table with a low-privileged user.

Valters IT
DevSecOps & Cyber Threat Intelligence