CVE-2024-55924: TYPO3 CMS CSRF Vulnerability

CVE-2024-55924 Overview

CVE-2024-55924 is a Cross-Site Request Forgery (CSRF) vulnerability in the TYPO3 Content Management Framework backend user interface. The flaw affects the deep link functionality and downstream components that accept state-changing actions via HTTP GET requests without enforcing the correct HTTP method. Attackers can exploit the vulnerability through the Scheduler Module to trigger pre-defined command classes, potentially leading to unauthorized data import or export. Exploitation requires an authenticated backend session and user interaction with a malicious URL. The issue is classified under CWE-352: Cross-Site Request Forgery.

Critical Impact
An authenticated TYPO3 backend user tricked into visiting a crafted URL can trigger Scheduler command execution, resulting in unauthorized data import or export.

Affected Products

TYPO3 CMS versions prior to 11.5.42 ELTS
TYPO3 Scheduler Module (downstream component)
TYPO3 backend user interface deep link functionality

Discovery Timeline

2025-01-14 - CVE-2024-55924 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55924

Vulnerability Analysis

The vulnerability resides in the TYPO3 backend deep link functionality, which fails to validate CSRF tokens for requests reaching downstream components. Downstream components, notably the Scheduler Module, accept state-changing operations submitted through HTTP GET requests. This violates the safe-method contract for GET and enables cross-origin request forgery.

An attacker crafts a URL targeting the Scheduler Module and delivers it via email or a compromised web page. When an authenticated backend user opens the URL, the browser transmits session cookies and the malicious action executes with that user's privileges. The Scheduler command classes reachable through this path support data import and export operations.

Root Cause

The root cause combines two defects. First, deep link handling in the backend does not enforce CSRF token validation for downstream state-changing requests. Second, downstream components accept HTTP GET for operations that mutate application state, contrary to REST safe-method conventions.

Attack Vector

Exploitation requires the victim to hold an active TYPO3 backend session and to interact with an attacker-supplied URL. The attack succeeds when the security.backend.enforceReferrer feature is disabled and the BE/cookieSameSite setting is configured to lax or none. Under these conditions, cross-site navigation attaches backend cookies to the forged request, and the Scheduler Module executes the referenced command class without additional confirmation.

No verified public proof-of-concept code is available. Refer to the TYPO3 Security Advisory SA-2025-009 and the GitHub Security Advisory GHSA-7835-fcv3-g256 for authoritative technical details.

Detection Methods for CVE-2024-55924

Indicators of Compromise

Unexpected Scheduler task executions or command class invocations in TYPO3 backend logs
HTTP GET requests to Scheduler Module endpoints originating from external Referer headers
Unauthorized data import or export artifacts appearing in TYPO3 storage
Backend session activity correlated with cross-origin navigation events

Detection Strategies

Inspect web server access logs for GET requests to /typo3/module/system/scheduler and related deep link paths carrying state-changing parameters.
Correlate backend user session cookies with off-domain Referer values to identify likely CSRF attempts.
Review Scheduler execution history for command classes executed outside of scheduled windows or without operator context.

Monitoring Recommendations

Enable and centralize TYPO3 backend audit logs to a SIEM or log aggregation platform.
Alert on Scheduler command executions triggered interactively rather than through the cron runner.
Monitor for spikes in backend GET traffic from authenticated administrative users.

How to Mitigate CVE-2024-55924

Immediate Actions Required

Upgrade TYPO3 to version 11.5.42 ELTS or later as published in the TYPO3 core security advisory.
Enable security.backend.enforceReferrer in backend configuration.
Set BE/cookieSameSite to strict to block cross-site cookie attachment.
Audit Scheduler task history for unauthorized command class executions since the vulnerability disclosure.

Patch Information

TYPO3 has released version 11.5.42 ELTS addressing this issue. The fix enforces CSRF token validation on deep link handlers and restricts downstream Scheduler actions to HTTP POST. Details are provided in the TYPO3 Security Advisory SA-2025-009 and the GitHub Security Advisory GHSA-7835-fcv3-g256.

Workarounds

No official workarounds exist. The vendor requires upgrading to the patched release.
As a compensating control, restrict backend access to trusted networks via VPN or IP allow-listing until patching completes.
Instruct backend users to sign out of active sessions before browsing untrusted content or opening links from external sources.

bash

# Configuration example: harden backend session cookies and referrer enforcement
# LocalConfiguration.php or AdditionalConfiguration.php
$GLOBALS['TYPO3_CONF_VARS']['BE']['cookieSameSite'] = 'strict';
$GLOBALS['TYPO3_CONF_VARS']['SYS']['features']['security.backend.enforceReferrer'] = true;

# Upgrade via Composer
composer require typo3/cms-core:^11.5.42