CVE-2024-55921: 
PHP vulnerability analysis and mitigation

TYPO3, a free and open source Content Management Framework, disclosed a vulnerability (CVE-2024-55921) in its backend user interface functionality on January 14, 2025. The vulnerability involves deep links and is susceptible to Cross-Site Request Forgery (CSRF). The affected versions include TYPO3 10.0.0-10.4.47, 11.0.0-11.5.41, 12.0.0-12.4.24, and 13.0.0-13.4.2 (GitHub Advisory, TYPO3 Advisory).

The vulnerability stems from state-changing actions in downstream components that incorrectly accepted submissions via HTTP GET and did not enforce the appropriate HTTP method. The issue specifically affects the Extension Manager Module component. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The weakness types identified include CWE-352 (Cross-Site Request Forgery) and CWE-749 (Exposed Dangerous Method or Function) (GitHub Advisory).

Successful exploitation of this vulnerability allows attackers to retrieve and install 3rd party extensions from the TYPO3 Extension Repository, which can potentially lead to remote code execution in the worst case. The vulnerability affects the confidentiality, integrity, and availability of the system with high severity ratings for all three aspects (GitHub Advisory, TYPO3 Advisory).

The vulnerability has been patched in TYPO3 versions 11.5.42 ELTS, 12.4.25 LTS, and 13.4.3 LTS. Users are recommended to update to these versions. Additionally, it is recommended to keep the security.backend.enforceReferrer feature enabled and set BE/cookieSameSite to strict, which are the default settings. Extension authors are advised to review and update their codebase accordingly (TYPO3 Advisory).

The vulnerability was responsibly disclosed and addressed with the collaboration of TYPO3 core and security members including Benjamin Franzke, Oliver Hader, Andreas Kienast, Torben Hansen, and Elias Häußler. The initial discovery was credited to Gabriel Dimitrov (TYPO3 Advisory).