CVE-2025-47936: TYPO3 CMS Webhook CSRF Vulnerability

CVE-2025-47936 Overview

CVE-2025-47936 affects TYPO3, an open source PHP-based web content management system. The vulnerability exists in the Webhooks feature, which is inherently susceptible to Cross-Site Request Forgery (CSRF). An attacker can abuse this behavior to reach internal resources such as localhost or other services on the local network, producing a Server-Side Request Forgery (SSRF) condition [CWE-918]. Exploitation requires an authenticated administrator-level backend user account. Affected releases include TYPO3 12.x prior to 12.4.31 LTS and 13.x prior to 13.4.2 LTS.

Critical Impact
Authenticated administrators can trigger webhook requests that blindly probe internal systems normally isolated from external networks.

Affected Products

TYPO3 12.x versions prior to 12.4.31 LTS
TYPO3 13.x versions prior to 13.4.2 LTS
Deployments exposing the backend Webhooks module to administrator accounts

Discovery Timeline

2025-05-20 - CVE-2025-47936 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47936

Vulnerability Analysis

TYPO3 Webhooks issue outbound HTTP requests to URLs defined by backend administrators. Because the feature does not enforce a network allowlist or block requests to internal addresses, an administrator-triggered webhook can target any host reachable from the TYPO3 server. This creates a Server-Side Request Forgery primitive [CWE-918] usable to enumerate internal services, cloud metadata endpoints, or loopback-bound admin interfaces. The CSRF component compounds the risk: a malicious page loaded by an authenticated administrator can cause the backend to issue webhook configuration or invocation requests without explicit consent. The TYPO3 team notes this is inherent to how webhooks operate rather than a defect isolated to a single function.

Root Cause

The root cause is the absence of destination validation on webhook target URLs combined with insufficient CSRF protection on the webhook administration flow. Administrator-authored URLs are trusted implicitly, so requests to 127.0.0.1, 169.254.169.254, or RFC1918 ranges are dispatched without restriction.

Attack Vector

Exploitation requires a valid administrator backend session. An attacker either compromises administrator credentials or lures an authenticated administrator to a malicious page that submits crafted webhook requests. The webhook subsystem then issues attacker-controlled requests from the TYPO3 server toward internal endpoints, returning limited response signals that can still be used to fingerprint internal services.

No verified public exploit code is available. Refer to the TYPO3 Security Advisory and GitHub Security Advisory GHSA-p4xx-m758-3hpx for authoritative technical details.

Detection Methods for CVE-2025-47936

Indicators of Compromise

Outbound HTTP requests from the TYPO3 web server to loopback addresses (127.0.0.0/8), link-local (169.254.0.0/16), or RFC1918 ranges originating from the webhook dispatcher.
Webhook configuration entries pointing to internal hostnames, cloud metadata services, or non-standard internal ports.
Backend audit log entries showing webhook creation or modification correlated with unexpected administrator session activity.

Detection Strategies

Review TYPO3 backend logs (sys_log) for webhook create, update, and execute events tied to administrator accounts.
Correlate web server egress traffic with webhook execution timestamps to identify requests targeting internal ranges.
Alert on cross-origin POST requests to backend webhook endpoints that lack expected referer or origin headers.

Monitoring Recommendations

Instrument outbound proxy or firewall logs to flag TYPO3-originated requests destined for internal networks.
Monitor administrator session activity for anomalous webhook-related actions outside normal maintenance windows.
Track TYPO3 version inventory to confirm all instances run 12.4.31 LTS, 13.4.2 LTS, or later.

How to Mitigate CVE-2025-47936

Immediate Actions Required

Upgrade TYPO3 to version 12.4.31 LTS or 13.4.12 LTS as directed by the vendor advisory.
Audit existing webhook configurations and remove entries targeting internal or loopback addresses.
Enforce multi-factor authentication on all backend administrator accounts to reduce CSRF and credential-theft exposure.

Patch Information

The TYPO3 project addressed this issue in TYPO3 12.4.31 LTS and TYPO3 13.4.12 LTS. Details are published in TYPO3-CORE-SA-2025-012 and the GitHub Security Advisory. Administrators should apply the upgrade before adjusting configurations.

Workarounds

Restrict backend access to administrators via IP allowlists or VPN to reduce CSRF exposure until patching completes.
Deploy an egress proxy that blocks TYPO3 outbound requests to loopback, link-local, and internal CIDR ranges.
Temporarily disable the Webhooks module in environments where it is not required.

bash

# Example egress restriction using iptables to block internal SSRF targets
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT