CVE-2024-55922: TYPO3 CMS Backend CSRF Vulnerability

CVE-2024-55922 Overview

CVE-2024-55922 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 Content Management Framework backend user interface. The flaw resides in the deep links functionality, where state-changing actions in downstream components accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. The downstream Form Framework Module is affected, allowing attackers to manipulate or delete persisted form definitions. Successful exploitation requires an authenticated backend user to be deceived into interacting with a malicious URL. The vulnerability is classified under CWE-352.

Critical Impact
Attackers can manipulate or delete persisted form definitions in the TYPO3 Form Framework Module by tricking an authenticated backend user into visiting a crafted URL.

Affected Products

TYPO3 versions prior to 11.5.42 ELTS
TYPO3 versions prior to 12.4.25 LTS
TYPO3 versions prior to 13.4.3 LTS

Discovery Timeline

2025-01-14 - CVE-2024-55922 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55922

Vulnerability Analysis

The vulnerability affects the TYPO3 backend user interface deep links functionality. Downstream state-changing components accept HTTP GET requests instead of restricting sensitive operations to POST or other appropriate methods. This design flaw exposes those actions to Cross-Site Request Forgery (CSRF) abuse.

Exploitation requires the victim to hold an active authenticated session on the TYPO3 backend. When the victim opens a malicious link or visits a compromised website, the browser submits authenticated requests to the TYPO3 backend on behalf of the user. The impact is scoped to the Form Framework Module, where attackers can manipulate or delete stored form definitions.

Root Cause

The root cause is twofold. First, the deep links feature in the backend lacks CSRF protection for the affected actions. Second, downstream components incorrectly accept state-changing operations over HTTP GET. Combined, these design defects allow cross-origin requests to trigger persistent modifications when the victim is authenticated.

Attack Vector

Exploitation requires user interaction and specific misconfiguration. The victim must have an active backend session and be lured into loading a malicious URL. The attack succeeds when security.backend.enforceReferrer is disabled and BE/cookieSameSite is set to lax or none. Under these conditions, the browser attaches the backend session cookie to attacker-initiated requests targeting the Form Framework Module.

No verified proof-of-concept code is publicly available. See the TYPO3 Security Advisory SA-2025-007 and the GitHub Security Advisory GHSA-ww7h-g2qf-7xv6 for authoritative technical details.

Detection Methods for CVE-2024-55922

Indicators of Compromise

Unexpected modifications or deletions of persisted form definitions in the TYPO3 Form Framework Module.
Backend HTTP GET requests to state-changing endpoints originating from external Referer headers.
Authenticated backend actions immediately following user navigation from external, untrusted domains.

Detection Strategies

Review TYPO3 backend access logs for cross-origin requests reaching Form Framework endpoints while a valid backend session cookie is present.
Correlate form definition change events in the TYPO3 audit log with the originating request method and Referer header.
Alert on state-changing backend requests received via HTTP GET rather than POST.

Monitoring Recommendations

Monitor changes to form definitions stored by the Form Framework Module and flag deletions or modifications performed outside expected editorial workflows.
Track TYPO3 backend session activity for anomalous request patterns tied to tx_form or related route identifiers.
Ingest TYPO3 backend logs into a centralized logging or SIEM platform to enable retrospective hunting across CSRF-style access patterns.

How to Mitigate CVE-2024-55922

Immediate Actions Required

Upgrade TYPO3 to a fixed release: 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS.
Enable the security.backend.enforceReferrer feature to reject backend requests lacking a valid Referer.
Set BE/cookieSameSite to strict to prevent the backend session cookie from being attached to cross-site requests.
Audit the Form Framework Module for unauthorized changes to persisted form definitions.

Patch Information

TYPO3 has released patched versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS that remediate the CSRF weakness and enforce correct HTTP methods on state-changing operations. Refer to the TYPO3 Security Advisory SA-2025-007 and the GitHub Security Advisory GHSA-ww7h-g2qf-7xv6 for release details.

Workarounds

No official workarounds exist per the TYPO3 advisory. Apply the vendor patch as the primary remediation.
As a defense-in-depth measure until patching, ensure security.backend.enforceReferrer is enabled and BE/cookieSameSite is set to strict.
Restrict backend access to trusted networks or via VPN to reduce exposure to malicious external links.

bash

# Configuration example - hardening TYPO3 backend against CSRF
# In LocalConfiguration.php / additional configuration:
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'strict';
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.backend.enforceReferrer'] = true;