CVE-2024-55922
📋 TL;DR
This CSRF vulnerability in TYPO3's backend allows attackers to manipulate or delete form definitions when authenticated backend users interact with malicious URLs. It affects TYPO3 installations with specific misconfigurations. Only users with backend access are vulnerable.
💻 Affected Systems
- TYPO3 CMS
📦 What is this software?
Typo3 by Typo3
Typo3 by Typo3
Typo3 by Typo3
Typo3 by Typo3
⚠️ Risk & Real-World Impact
Worst Case
Attackers could delete or modify all form definitions, disrupting form functionality across the website.
Likely Case
Selective manipulation or deletion of form definitions, causing form submission issues.
If Mitigated
No impact if proper referrer enforcement and cookie settings are configured.
🎯 Exploit Status
Requires authenticated backend user to click malicious link; exploit depends on specific misconfigurations.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS
Vendor Advisory: https://typo3.org/security/advisory/typo3-core-sa-2025-007
Restart Required: No
Instructions:
1. Identify your TYPO3 version. 2. Update to the patched version matching your release line. 3. Clear caches via Install Tool or CLI.
🔧 Temporary Workarounds
Enable Referrer Enforcement
allSet security.backend.enforceReferrer to true in LocalConfiguration.php
$TYPO3_CONF_VARS['BE']['enforceReferrer'] = true;
Configure Secure Cookie Settings
allSet BE/cookieSameSite to 'strict' in LocalConfiguration.php
$TYPO3_CONF_VARS['BE']['cookieSameSite'] = 'strict';
🧯 If You Can't Patch
- Implement both workarounds: enable referrer enforcement and set cookieSameSite to strict
- Educate backend users about phishing risks and safe browsing practices
🔍 How to Verify
Check if Vulnerable:
Check TYPO3 version and configuration: version must be below patched versions AND both misconfigurations presentCheck Version:
Check typo3/sysext/core/Classes/Information/Typo3Version.php or Admin PanelVerify Fix Applied:
Confirm TYPO3 version is 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS or higher📡 Detection & Monitoring
Log Indicators:
- Unexpected form definition modifications or deletions in backend logs
Network Indicators:
- Unusual backend requests with external referrers
SIEM Query:
Search for backend form manipulation events from unexpected IPs or with suspicious referrers