CVE-2024-55920 Overview
CVE-2024-55920 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the TYPO3 Content Management Framework backend user interface. The flaw resides in the deep link functionality and downstream components that incorrectly accept state-changing actions via HTTP GET without enforcing the proper HTTP method. An authenticated backend user who follows a crafted link can have their Dashboard Module configuration manipulated by an attacker. Exploitation requires user interaction and specific misconfigurations of the security.backend.enforceReferrer feature and the BE/cookieSameSite setting. TYPO3 released fixed versions on January 14, 2025.
Critical Impact
Attackers can modify a victim's TYPO3 backend dashboard configuration when the victim is deceived into visiting a malicious URL with an active backend session.
Affected Products
- TYPO3 versions prior to 11.5.42 ELTS
- TYPO3 versions prior to 12.4.25 LTS
- TYPO3 versions prior to 13.4.3 LTS
Discovery Timeline
- 2025-01-14 - CVE-2024-55920 published to NVD
- 2025-01-14 - TYPO3 releases fixed versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-55920
Vulnerability Analysis
The vulnerability affects the TYPO3 backend user interface deep link functionality. Deep links in the backend allow direct navigation to specific administrative modules or actions. The affected implementation fails to require CSRF token validation for state-changing operations reachable through this feature. Downstream components, including the Dashboard Module, further compound the issue by accepting state-changing requests over HTTP GET rather than restricting mutations to POST or other appropriate methods. When both weaknesses combine, a crafted URL alone becomes sufficient to alter server-side state on behalf of an authenticated backend user.
Root Cause
The root cause is missing CSRF protection [CWE-352] in the deep link handler paired with improper HTTP method enforcement in downstream modules. State-changing actions such as dashboard configuration updates should require an anti-forgery token and reject GET requests. Because neither control is enforced consistently, requests originating from external contexts are treated as legitimate backend actions when the user carries a valid session cookie.
Attack Vector
Exploitation requires the victim to hold an active TYPO3 backend session and interact with an attacker-controlled URL, delivered by email or hosted on a compromised site. Two configuration conditions must also be met: the security.backend.enforceReferrer feature must be disabled, and the BE/cookieSameSite setting must be lax or none. When these conditions align, the browser transmits the backend session cookie with the forged request, and the Dashboard Module processes the attacker-supplied parameters. The result is unauthorized modification of the victim's dashboard configuration without any credential compromise.
Detection Methods for CVE-2024-55920
Indicators of Compromise
- Unexpected changes to backend user dashboard widget configurations without corresponding administrator activity.
- Backend HTTP GET requests targeting dashboard configuration endpoints originating from external Referer headers.
- Web server access logs showing authenticated backend requests immediately following external-site referrals.
Detection Strategies
- Review TYPO3 web server logs for state-changing requests to backend routes that arrived via HTTP GET rather than POST.
- Correlate backend session activity with Referer and Origin headers to identify requests initiated from untrusted sources.
- Audit dashboard configuration changes against the TYPO3 backend user activity log for discrepancies.
Monitoring Recommendations
- Enable and centralize TYPO3 backend access and audit logging to a SIEM for correlation with authentication events.
- Alert on any backend administrative action that lacks an expected CSRF token parameter in the request.
- Monitor for backend user session activity originating from unusual browsing contexts or referrers.
How to Mitigate CVE-2024-55920
Immediate Actions Required
- Upgrade TYPO3 to version 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS depending on your deployed branch.
- Enable the security.backend.enforceReferrer feature to reject backend requests with missing or untrusted Referer headers.
- Set the BE/cookieSameSite configuration to strict to prevent backend session cookies from being sent on cross-site requests.
- Instruct backend users to log out of active sessions before browsing untrusted content.
Patch Information
TYPO3 addressed the vulnerability in versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS. Details are available in the TYPO3 Security Advisory TYPO3-CORE-SA-2025-005 and the GitHub Security Advisory GHSA-qwx7-39pw-2mhr.
Workarounds
- No official workarounds exist; upgrading to a fixed version is required.
- As a hardening measure until patching, ensure security.backend.enforceReferrer is enabled and BE/cookieSameSite is set to strict.
- Restrict backend interface access to trusted networks or VPN clients to limit exposure to malicious external links.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
