CVE-2024-55945: TYPO3 CMS Backend CSRF Vulnerability

CVE-2024-55945 Overview

CVE-2024-55945 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the TYPO3 Content Management Framework backend user interface. The flaw resides in deep link functionality, where state-changing actions in downstream components incorrectly accept submissions via HTTP GET without enforcing proper HTTP method restrictions. The affected DB Check Module allows attackers to manipulate data through unauthorized actions when a victim with an active backend session is deceived into interacting with a malicious URL. TYPO3 released fixed builds in version 11.5.42 ELTS.

Critical Impact
Successful exploitation permits attackers to trigger unauthorized state-changing operations in the TYPO3 backend, resulting in data manipulation through the DB Check Module when an authenticated administrator visits a crafted link.

Affected Products

TYPO3 CMS versions prior to 11.5.42 ELTS
TYPO3 backend user interface deep link functionality
TYPO3 DB Check Module downstream component

Discovery Timeline

2025-01-14 - CVE-2024-55945 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-55945

Vulnerability Analysis

The vulnerability affects the TYPO3 backend user interface, specifically the deep link handling logic that routes requests to downstream modules. State-changing actions within these downstream components accept HTTP GET submissions rather than restricting operations to POST or other appropriate methods. This design choice bypasses the anti-CSRF token verification typically enforced on state-changing endpoints. Attackers can craft malicious URLs targeting the DB Check Module and exploit an authenticated administrator's active session to perform unauthorized data manipulation.

Root Cause

The root cause is twofold. First, deep link handlers in the backend do not enforce CSRF protection on requests routed to certain downstream modules. Second, state-changing endpoints in the DB Check Module accept HTTP GET requests, violating the principle that side-effecting operations must require safe HTTP methods such as POST. The issue is aggravated when the security.backend.enforceReferrer feature is disabled and BE/cookieSameSite is set to lax or none, allowing cross-origin session cookies to accompany the attacker-crafted request.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker sends a malicious link via email or hosts it on a compromised website. When an authenticated TYPO3 backend administrator clicks the link or visits the page, the browser issues an HTTP GET request to the deep link endpoint carrying the victim's active backend session cookie. The DB Check Module processes the state-changing action without validating the origin or method, resulting in data manipulation. Exploitation is possible only when the affected backend configuration options are misconfigured.

No verified proof-of-concept code is publicly available. Refer to the TYPO3 Security Advisory for technical specifics.

Detection Methods for CVE-2024-55945

Indicators of Compromise

Unexpected HTTP GET requests to TYPO3 backend deep link endpoints, particularly those targeting the DB Check Module.
Backend audit log entries showing state-changing actions correlated with Referer headers pointing to untrusted external domains.
Database modifications performed under an administrator account without a corresponding authenticated backend workflow.

Detection Strategies

Inspect web server logs for GET requests to backend module paths that historically only accept POST for state changes.
Correlate TYPO3 sys_log entries with proxy or WAF logs to identify state-changing operations initiated from external referrers.
Deploy WAF rules that flag backend requests missing valid CSRF tokens or expected same-origin Referer headers.

Monitoring Recommendations

Enable verbose backend audit logging in TYPO3 and forward events to a centralized SIEM for correlation.
Monitor administrator session activity for anomalous URL patterns immediately following email or web browsing activity.
Alert on configuration drift where security.backend.enforceReferrer becomes disabled or BE/cookieSameSite is downgraded from strict.

How to Mitigate CVE-2024-55945

Immediate Actions Required

Upgrade TYPO3 to version 11.5.42 ELTS or later, which contains the vendor fix for this CSRF vulnerability.
Verify that security.backend.enforceReferrer is enabled in the backend configuration.
Set BE/cookieSameSite to strict to prevent cross-site cookie transmission during CSRF attempts.
Instruct backend administrators to log out of the TYPO3 backend when not actively performing administrative work.

Patch Information

TYPO3 addressed the vulnerability in version 11.5.42 ELTS. Full patch details are available in the GitHub Security Advisory GHSA-8mv3-37rc-pvxj and the TYPO3 Core Security Advisory TYPO3-CORE-SA-2025-010. No workarounds exist; upgrading is the only supported remediation.

Workarounds

No vendor-supported workarounds exist for this vulnerability. Upgrading to the fixed release is required.
As a compensating control before patching, restrict backend access to trusted IP ranges via network ACLs or a reverse proxy.
Enforce short administrator session lifetimes to reduce the window in which a CSRF attack can succeed.

bash

# Configuration example: harden TYPO3 backend against CSRF exploitation
# LocalConfiguration.php snippet
'BE' => [
    'cookieSameSite' => 'strict',
],
'SYS' => [
    'features' => [
        'security.backend.enforceReferrer' => true,
    ],
],