CVE-2024-55924: TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery
Problem A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method.
Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions:
the user opens a malicious link, such as one sent via email. the user visits a compromised or manipulated website while the following settings are misconfigured: + security.backend.enforceReferrer feature is disabled, + BE/cookieSameSite configuration is set to lax or none
The vulnerability in the affected downstream component “Scheduler Module” allows attackers to trigger pre-defined command classes - which can lead to unauthorized import or export of data in the worst case.
Solution Update to TYPO3 versions 11.5.42 ELTS that fixes the problem described.
Credits Thanks to Gabriel Dimitrov who reported this issue and to TYPO3 core and security members Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, Elias Häußler who fixed the issue.
Other sources
TYPO3 is a free and open source Content Management Framework. A vulnerability has been identified in the backend user interface functionality involving deep links. Specifically, this functionality is susceptible to Cross-Site Request Forgery (CSRF). Additionally, state-changing actions in downstream components incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. Successful exploitation of this vulnerability requires the victim to have an active session on the backend user interface and to be deceived into interacting with a malicious URL targeting the backend, which can occur under the following conditions: The user opens a malicious link, such as one sent via email. The user visits a compromised or manipulated website while the following settings are misconfigured: 1. security.backend.enforceReferrer feature is disabled, 2. BE/cookieSameSite configuration is set to lax or none. The vulnerability in the affected downstream component “Scheduler Module” allows attackers to trigger pre-defined command classes - which can lead to unauthorized import or export of data in the worst case. Users are advised to update to TYPO3 versions 11.5.42 ELTS which fixes the problem described. There are no known workarounds for this vulnerability.
— NVD
TYPO3 Scheduler Module vulnerable to Cross-Site Request Forgery
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/typo3/cms-schedulerto a version that resolves this vulnerability.Fixed in 11.5.42 - Upgrade
Upgrade
TYPO3to a version that resolves this vulnerability.Fixed in 11.5.42 ELTS
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55924?
CVE-2024-55924 is classified as a medium severity vulnerability due to its potential exploitation in Cross-Site Request Forgery attacks.
How do I fix CVE-2024-55924?
To fix CVE-2024-55924, upgrade the TYPO3 CMS Scheduler package to version 11.5.42 or later.
Which versions of TYPO3 are affected by CVE-2024-55924?
CVE-2024-55924 affects TYPO3 versions from 11.0.0 to 11.5.41.
What type of vulnerability is CVE-2024-55924?
CVE-2024-55924 is specifically a Cross-Site Request Forgery (CSRF) vulnerability.
What components are impacted by CVE-2024-55924?
CVE-2024-55924 impacts the backend user interface functionality of the TYPO3 CMS, particularly involving deep links.