CVE-2024-55923: TYPO3 CMS CSRF Vulnerability

CVE-2024-55923 Overview

CVE-2024-55923 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the TYPO3 Content Management Framework backend user interface. The flaw affects deep-link functionality and downstream components that accept state-changing actions over HTTP GET without enforcing the correct HTTP method. An authenticated backend user tricked into visiting a malicious URL can trigger unauthorized actions. In the Indexed Search Module, exploitation allows an attacker to delete items belonging to the component. The issue is fixed in TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS.

Critical Impact
A logged-in TYPO3 backend user who clicks a crafted link can unknowingly delete Indexed Search Module items, resulting in loss of integrity for search data.

Affected Products

TYPO3 versions prior to 11.5.42 ELTS
TYPO3 versions prior to 12.4.25 LTS
TYPO3 versions prior to 13.4.3 LTS

Discovery Timeline

2025-01-14 - CVE-2024-55923 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55923

Vulnerability Analysis

The vulnerability resides in the TYPO3 backend user interface, specifically in deep-link handling and downstream components reached through those links. State-changing operations were exposed via HTTP GET requests and lacked CSRF token validation. This design allowed an attacker to craft URLs that, when loaded by an authenticated backend user, executed privileged actions on that user's behalf.

The Indexed Search Module is the confirmed downstream component. An attacker abusing the flaw can delete items managed by this component. Because the request originates from the victim's authenticated session, the backend processes it as legitimate administrative activity.

Root Cause

Two defects combine to produce the vulnerability. First, deep-link entry points in the backend UI did not enforce CSRF protection. Second, downstream handlers accepted state-changing submissions over HTTP GET rather than restricting mutating operations to POST with anti-CSRF tokens. The Indexed Search Module inherited this weakness and exposed a deletion action reachable by a simple GET request.

Attack Vector

Exploitation requires user interaction. The victim must have an active TYPO3 backend session and must load an attacker-controlled URL, either through a phishing email or by visiting a compromised site. Successful exploitation additionally depends on misconfiguration: the security.backend.enforceReferrer feature must be disabled, and BE/cookieSameSite must be set to lax or none. When these conditions are met, the browser attaches session cookies to the cross-site request and the backend executes the malicious action.

No verified proof-of-concept code has been published. Refer to the TYPO3 Security Advisory TYPO3-CORE-SA-2025-008 and the GitHub Security Advisory GHSA-7r5q-4qgx-v545 for authoritative technical details.

Detection Methods for CVE-2024-55923

Indicators of Compromise

Unexpected deletions of entries in the Indexed Search Module without corresponding administrator activity in audit logs.
Backend HTTP GET requests to state-changing endpoints originating from external Referer headers.
Backend session activity immediately following an outbound click from webmail or third-party sites.

Detection Strategies

Review TYPO3 backend access logs for GET requests to Indexed Search Module endpoints that perform deletion actions.
Correlate sys_log and web server logs to identify state-changing GET requests lacking a matching CSRF token parameter.
Alert on backend requests whose Referer header points to an untrusted external origin while security.backend.enforceReferrer is disabled.

Monitoring Recommendations

Enable and centrally collect TYPO3 backend audit logs to detect anomalous administrative actions.
Monitor changes to BE/cookieSameSite and security.backend.enforceReferrer configuration values.
Track authenticated backend user sessions for cross-origin request patterns typical of CSRF exploitation.

How to Mitigate CVE-2024-55923

Immediate Actions Required

Upgrade TYPO3 to 11.5.42 ELTS, 12.4.25 LTS, or 13.4.3 LTS depending on the branch in use.
Enable the security.backend.enforceReferrer feature to block cross-site backend requests.
Set BE/cookieSameSite to strict to prevent the browser from sending backend session cookies on cross-origin requests.
Instruct backend editors to log out when not actively working in TYPO3.

Patch Information

TYPO3 addressed the flaw by enforcing CSRF token validation on affected deep-link entry points and restricting state-changing actions in downstream components, including the Indexed Search Module, to appropriate HTTP methods. Patched releases are 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS. See the TYPO3 Security Advisory TYPO3-CORE-SA-2025-008 for full remediation guidance.

Workarounds

No official workarounds are available. Upgrading to a fixed version is required.
As a compensating control, harden backend cookies with BE/cookieSameSite=strict and enable security.backend.enforceReferrer to reduce exposure until patching completes.

bash

# Configuration example: harden TYPO3 backend against CSRF
# LocalConfiguration.php (excerpt)
'BE' => [
    'cookieSameSite' => 'strict',
],
'SYS' => [
    'features' => [
        'security.backend.enforceReferrer' => true,
    ],
],