CVE-2024-55922: TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method.
Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions:
the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none
The vulnerability in the affected downstream component “Form Framework Module” allows attackers to manipulate or delete persisted form definitions.
Solution Update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS that fix the problem described.
Credits Thanks to TYPO3 core and security members Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, Elias Häußler who fixed the issue.
References TYPO3-CORE-SA-2025-007
Other sources
TYPO3 Form Framework Module vulnerable to Cross-Site Request Forgery
— Packagist
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none The vulnerability in the affected downstream component “Form Framework Module” allows attackers to manipulate or delete persisted form definitions. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this vulnerability.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 13.4.3 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 12.4.25 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 11.5.42 - Upgrade
Upgrade
composer/typo3/cms-formto a version that resolves this vulnerability.Fixed in 10.4.48 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 11.5.42 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 12.4.25 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 13.4.3 - Configuration
Enable the security.backend.enforceReferrer feature.
TYPO3 backend security.backend.enforceReferrer = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55922?
CVE-2024-55922 has been classified as a high severity vulnerability due to its CSRF exploitation potential.
How do I fix CVE-2024-55922?
To fix CVE-2024-55922, upgrade the TYPO3 CMS Form package to versions 13.4.3, 12.4.25, 11.5.42, or 10.4.48.
Which TYPO3 CMS Form versions are affected by CVE-2024-55922?
Versions of TYPO3 CMS Form from 13.0.0 to 13.4.2, 12.0.0 to 12.4.24, 11.0.0 to 11.5.41, and 10.0.0 to 10.4.47 are affected by CVE-2024-55922.
What types of attacks could exploit CVE-2024-55922?
CVE-2024-55922 could be exploited through Cross-Site Request Forgery attacks that perform unauthorized state-changing actions.
Is there a CVE-2024-55922 workaround before applying the patch?
While applying the patch is the best solution, temporarily restricting backend access to trusted IPs may help mitigate risks associated with CVE-2024-55922.