CVE-2024-55893: TYPO3 cms-belog Cross-Site Request Forgery Vulnerability
Summary
CVE-2024-55893: TYPO3 Cross-Site Request Forgery in Log Module. Affects typo3/cms-belog across 4 version ranges.
>= 10.0.0, < 10.4.48
>= 11.0.0, < 11.5.42
>= 12.0.0, < 12.4.25
>= 13.0.0, < 13.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
TYPO3 is an open-source content management system (CMS) that enables users to create and manage websites efficiently. The 'cms-belog' package is part of TYPO3's backend logging module, which tracks user actions and system events. This package is crucial for maintaining security and auditing in TYPO3 installations. However, it has been found vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can compromise the integrity of the logging system and allow unauthorized actions.
Vulnerability Detail
The vulnerability arises from the backend user interface's handling of deep links, which are susceptible to CSRF. Attackers can exploit this flaw by tricking users into clicking malicious links while they are logged into the TYPO3 backend. If the user interacts with such a link, it can lead to unauthorized state-changing actions, such as the deletion of log entries. The issue is exacerbated if certain security settings are misconfigured, such as disabling the 'security.backend.enforceReferrer' feature or setting 'BE/cookieSameSite' to 'lax' or 'none'.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.4.4810.4.48composer require typo3/cms-belog:10.4.48 -
>= 11.0.0, < 11.5.4211.5.42composer require typo3/cms-belog:11.5.42 -
>= 12.0.0, < 12.4.2512.4.25composer require typo3/cms-belog:12.4.25 -
>= 13.0.0, < 13.4.313.4.3composer require typo3/cms-belog:13.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, ensure that the 'security.backend.enforceReferrer' feature is enabled and configure 'BE/cookieSameSite' to 'strict' to mitigate the risk of CSRF attacks until the package can be updated.
Conclusion
The TYPO3 cms-belog package is vulnerable to CSRF attacks, which can lead to unauthorized actions within the backend logging module. It is crucial to update to the latest patched versions to mitigate this risk. Additionally, implementing recommended workarounds can provide temporary protection until the update is applied.
See every vulnerability recorded for typo3/cms-belog →
FAQ
CSRF is an attack that tricks a user into executing unwanted actions on a web application in which they are authenticated.
You can check your installation against the vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
Exploitation of this vulnerability can lead to unauthorized actions, such as the deletion of important log entries, which can compromise system integrity.
Yes, Vulert can monitor your application for open-source vulnerabilities using just the composer.lock file, providing real-time alerts.
The CVSS score for this vulnerability is 4.3, indicating a moderate severity level.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
