CVE-2024-55921: Cross-Site Request Forgery in Extension Manager Module in TYPO3
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method.
Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions:
the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none
The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case.
Solution Update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS that fix the problem described.
Credits Thanks to TYPO3 core and security members Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, Elias Häußler who fixed the issue.
References TYPO3-CORE-SA-2025-006
Other sources
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Extension Manager Module” allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository - which can lead to remote code execution in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55921?
CVE-2024-55921 is classified as a moderate severity vulnerability due to its potential for exploitation through Cross-Site Request Forgery (CSRF).
How do I fix CVE-2024-55921?
To resolve CVE-2024-55921, upgrade the TYPO3 cms-extensionmanager to versions 13.4.3, 12.4.25, 11.5.42, or 10.4.48 depending on your current version.
Which versions of TYPO3 are affected by CVE-2024-55921?
CVE-2024-55921 affects TYPO3 versions from 10.0.0 to 10.4.47, 11.0.0 to 11.5.41, 12.0.0 to 12.4.24, and 13.0.0 to 13.4.2.
What type of attack does CVE-2024-55921 enable?
CVE-2024-55921 enables Cross-Site Request Forgery (CSRF) attacks that can lead to unauthorized state-changing actions in downstream components.
What components are affected by CVE-2024-55921?
CVE-2024-55921 specifically affects the backend user interface functionality of the TYPO3 cms-extensionmanager.