CVE-2024-55921: TYPO3 CMS Backend CSRF Vulnerability

CVE-2024-55921 Overview

CVE-2024-55921 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 Content Management Framework backend user interface. The flaw affects the deep links functionality and downstream components that incorrectly accept state-changing actions via HTTP GET requests. Attackers can exploit the Extension Manager Module to retrieve and install third-party extensions from the TYPO3 Extension Repository, potentially leading to remote code execution. Successful exploitation requires an authenticated backend session and user interaction with a malicious URL. The vulnerability is tracked as CWE-352 and is addressed in TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS.

Critical Impact
Authenticated backend users tricked into visiting a malicious URL can have arbitrary third-party extensions installed, enabling remote code execution on the TYPO3 instance.

Affected Products

TYPO3 versions prior to 11.5.42 ELTS
TYPO3 versions prior to 12.4.25 LTS
TYPO3 versions prior to 13.4.3 LTS

Discovery Timeline

2025-01-14 - CVE-2024-55921 published to the National Vulnerability Database (NVD)
2025-08-26 - Last updated in NVD database

Technical Details for CVE-2024-55921

Vulnerability Analysis

The vulnerability resides in the TYPO3 backend deep links functionality. The framework fails to enforce CSRF protections on backend interfaces that initiate state-changing operations. Downstream components, including the Extension Manager Module, accept HTTP GET submissions for actions that should require HTTP POST with anti-CSRF tokens. An attacker can craft a URL that, when loaded by an authenticated backend user, triggers installation of arbitrary extensions from the TYPO3 Extension Repository. Because TYPO3 extensions execute PHP code within the application context, the chain can escalate to remote code execution on the host.

Root Cause

The root cause is missing CSRF token enforcement on backend deep link handlers combined with improper HTTP method validation [CWE-352]. State-changing endpoints in components such as the Extension Manager Module process GET requests without verifying request origin or a synchronizer token.

Attack Vector

Exploitation requires three conditions. The victim must hold an active authenticated session in the TYPO3 backend. The victim must follow a malicious link delivered through email, chat, or a compromised website. The target installation must have the security.backend.enforceReferrer feature disabled or BE/cookieSameSite configured to lax or none. When these conditions align, the attacker-controlled request executes within the victim's session and installs an attacker-chosen extension.

No verified public exploit code is available. See the TYPO3 Security Advisory SA-2025-006 and the GitHub Security Advisory GHSA-4g52-pq8j-6qv5 for vendor technical details.

Detection Methods for CVE-2024-55921

Indicators of Compromise

Unexpected entries in the TYPO3 extension installation logs or typo3temp/ directory referencing extensions that administrators did not install.
Backend web server access logs showing GET requests to Extension Manager endpoints originating from external Referer headers.
New or modified PHP files within typo3conf/ext/ that correspond to recently fetched third-party extensions.
Outbound HTTP connections from the TYPO3 host to extensions.typo3.org immediately following a backend user session.

Detection Strategies

Audit web server logs for backend URLs containing extension manager action parameters submitted via GET with cross-origin Referer values.
Compare the installed extension inventory against an approved baseline and alert on additions.
Monitor TYPO3 system logs (sys_log table) for extensionmanager module actions tied to user sessions that did not visit the module directly.

Monitoring Recommendations

Forward TYPO3 backend and web server logs to a centralized analytics platform for correlation across sessions and source IPs.
Alert on extension installation events outside of approved change windows.
Track changes to LocalConfiguration.php settings for security.backend.enforceReferrer and BE/cookieSameSite.

How to Mitigate CVE-2024-55921

Immediate Actions Required

Upgrade TYPO3 to 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS depending on the deployed branch.
Enable security.backend.enforceReferrer in TYPO3 system configuration.
Set BE/cookieSameSite to strict to prevent cross-site cookie transmission to the backend.
Review installed extensions and remove any that were not authorized by administrators.

Patch Information

TYPO3 GmbH released fixed versions on the project's standard release channel. Refer to the GitHub Security Advisory GHSA-4g52-pq8j-6qv5 and TYPO3 Security Advisory SA-2025-006 for patch details and upgrade instructions.

Workarounds

Restrict backend access to trusted networks using IP allowlists or VPN tunnels until patches are applied.
Instruct backend editors to log out of TYPO3 sessions when not actively administering the site.
Disable the Extension Manager Module for non-administrative users where business requirements allow.

bash

# Configuration example: harden TYPO3 backend against CSRF
# In typo3conf/LocalConfiguration.php (or via Install Tool):
# 'SYS' => [
#     'features' => [
#         'security.backend.enforceReferrer' => true,
#     ],
# ],
# 'BE' => [
#     'cookieSameSite' => 'strict',
# ],