CVE-2024-55923: TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method.
Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions:
the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none
The vulnerability in the affected downstream component “Indexed Search Module” allows attackers to delete items of the component.
Solution Update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS that fix the problem described.
Credits Thanks to TYPO3 core and security members Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, Elias Häußler who fixed the issue.
References TYPO3-CORE-SA-2025-008
Other sources
TYPO3 Indexed Search Module vulnerable to Cross-Site Request Forgery
— Packagist
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Indexed Search Module” allows attackers to delete items of the component. Users are advised to update to TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, 13.4.3 LTS which fix the problem described. There are no known workarounds for this issue.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-indexed-searchto a version that resolves this vulnerability.Fixed in 13.4.3 - Upgrade
Upgrade
composer/typo3/cms-indexed-searchto a version that resolves this vulnerability.Fixed in 12.4.25 - Upgrade
Upgrade
composer/typo3/cms-indexed-searchto a version that resolves this vulnerability.Fixed in 11.5.42 - Upgrade
Upgrade
composer/typo3/cms-indexed-searchto a version that resolves this vulnerability.Fixed in 10.4.48 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 11.5.42 ELTS - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 12.4.25 LTS - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 13.4.3 LTS - Configuration
Enable the security.backend.enforceReferrer feature.
TYPO3 backend security.backend.enforceReferrer = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55923?
The severity of CVE-2024-55923 is assessed as critical due to its susceptibility to Cross-Site Request Forgery (CSRF).
How do I fix CVE-2024-55923?
To fix CVE-2024-55923, upgrade to TYPO3 CMS Indexed Search versions 13.4.3, 12.4.25, 11.5.42, or 10.4.48 or later.
Who is affected by CVE-2024-55923?
CVE-2024-55923 affects users of TYPO3 CMS Indexed Search versions from 10.0.0 to 13.4.2.
What actions are impacted by CVE-2024-55923?
CVE-2024-55923 impacts state-changing actions within the backend user interface functionality.
Is there a workaround for CVE-2024-55923 before applying a fix?
No specific workaround is recommended for CVE-2024-55923, and upgrading to a secure version is advised.