CVE-2024-55891: Typo3 CMS Information Disclosure Vulnerability

CVE-2024-55891 Overview

CVE-2024-55891 affects TYPO3, a free and open source Content Management Framework. The install tool password is logged as plaintext when the configured password hashing mechanism is invalid or incorrect. This information disclosure flaw exposes sensitive administrative credentials in TYPO3 log files. An attacker with access to logs can retrieve the install tool password and gain administrative control over the affected TYPO3 instance. The issue is classified under [CWE-532: Insertion of Sensitive Information into Log File]. TYPO3 addressed the flaw in version 13.4.3 ELTS. No workarounds exist for this vulnerability.

Critical Impact
The install tool password is written in plaintext to log files, allowing anyone with log read access to obtain administrative credentials for the TYPO3 backend.

Affected Products

TYPO3 CMS version 13.4.2
TYPO3 installations using invalid password hashing mechanism configurations
TYPO3 releases prior to 13.4.3 ELTS

Discovery Timeline

2025-01-14 - CVE-2024-55891 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55891

Vulnerability Analysis

The vulnerability originates in the install tool authentication flow. When TYPO3 attempts to hash the install tool password using a mechanism that is not properly configured or is otherwise invalid, the framework falls back to a code path that writes the raw password value into the log stream. Log entries typically persist on disk under the TYPO3 var/log/ directory or are forwarded to centralized logging infrastructure. Any actor with read access to these destinations can extract the credential in cleartext. The install tool grants privileged control over site configuration, database credentials, extension management, and maintenance operations. Recovery of the install tool password therefore leads directly to full compromise of the CMS instance.

Root Cause

The flaw is an instance of [CWE-532], insertion of sensitive information into a log file. The password hashing error handler does not sanitize or redact the input before writing diagnostic output. The plaintext password becomes part of routine application logs rather than being suppressed or replaced with a placeholder.

Attack Vector

Exploitation is network-adjacent from the attacker's perspective but requires access to TYPO3 log storage. An unauthenticated remote actor cannot read the logs directly. However, secondary vulnerabilities that expose log files, misconfigured web servers that serve log directories, or shared hosting environments where log paths are readable can turn this into a remote credential disclosure. Insiders and any low-privileged user with filesystem or log aggregation access can retrieve the password without user interaction.

No verified public proof-of-concept code is available. See the TYPO3 Security Advisory SA-2025-001 and the GitHub Security Advisory GHSA-38x7-cc6w-j27q for vendor technical details.

Detection Methods for CVE-2024-55891

Indicators of Compromise

Log entries under the TYPO3 var/log/ directory containing install tool password values in cleartext.
Error or warning messages referencing an unknown or invalid password hashing mechanism during install tool authentication attempts.
Access events on log files or log aggregation endpoints from accounts that do not normally read TYPO3 diagnostics.

Detection Strategies

Grep TYPO3 log files for install tool authentication events and inspect surrounding context for exposed credentials.
Audit historical log archives and backups for the same patterns, since the exposure may have occurred before patching.
Correlate log-read events on TYPO3 hosts with user identity and workload to identify unauthorized access to diagnostic data.

Monitoring Recommendations

Forward TYPO3 application logs to a centralized SIEM with restricted access controls and immutable retention.
Alert on any process reading files under typo3temp/ or var/log/ outside of expected backup, log rotation, or shipping agents.
Track configuration changes to the password hashing mechanism in LocalConfiguration.php and treat unexpected changes as suspicious.

How to Mitigate CVE-2024-55891

Immediate Actions Required

Upgrade TYPO3 to version 13.4.3 ELTS or later, which contains the fix.
Rotate the install tool password immediately after upgrading, assuming any prior exposure in logs.
Purge or restrict access to historical log files and backups that may contain the plaintext credential.
Review who has filesystem, backup, and SIEM access to TYPO3 log destinations and reduce that access to the minimum necessary.

Patch Information

TYPO3 released the fix in version 13.4.3 ELTS. Refer to the TYPO3 Security Advisory SA-2025-001 and the GitHub Security Advisory GHSA-38x7-cc6w-j27q for release notes and remediation guidance.

Workarounds

No vendor-supplied workarounds are available. Upgrading to the patched release is the only supported remediation.
As an interim hardening measure, restrict filesystem permissions on TYPO3 log directories to the web server user only and block web access to log paths.

bash

# Restrict access to TYPO3 log directory as an interim hardening measure
chown -R www-data:www-data /var/www/typo3/var/log
chmod -R 750 /var/www/typo3/var/log

# Verify the installed TYPO3 version after upgrade
composer show typo3/cms-core | grep versions