CVE-2024-55920: TYPO3 cms-dashboard Cross-Site Request Forgery Vulnerability
Summary
CVE-2024-55920: TYPO3 Cross-Site Request Forgery in Dashboard Module. Affects typo3/cms-dashboard across 4 version ranges.
>= 10.0.0, < 10.4.48
>= 11.0.0, < 11.5.42
>= 12.0.0, < 12.4.25
>= 13.0.0, < 13.4.3
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TYPO3 is an open-source content management system (CMS) widely used for building and managing websites. The cms-dashboard package is a core component of TYPO3 that provides a user-friendly interface for backend users to manage their dashboard settings and configurations. However, it has been identified that this package is susceptible to a Cross-Site Request Forgery (CSRF) vulnerability, which can compromise the security of the backend user interface.
Vulnerability Detail
The vulnerability arises from the backend user interface's deep link functionality, which is not adequately protected against CSRF attacks. This flaw allows an attacker to manipulate a victim's dashboard configuration if the victim is tricked into clicking a malicious link while logged into the TYPO3 backend. The attack can be executed under specific conditions, such as when the security settings are misconfigured, allowing state-changing actions to be submitted via HTTP GET instead of the intended HTTP POST method. This can lead to unauthorized changes in the dashboard settings, potentially compromising the integrity of the system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.0, < 10.4.4810.4.48composer require typo3/cms-dashboard:10.4.48 -
>= 11.0.0, < 11.5.4211.5.42composer require typo3/cms-dashboard:11.5.42 -
>= 12.0.0, < 12.4.2512.4.25composer require typo3/cms-dashboard:12.4.25 -
>= 13.0.0, < 13.4.313.4.3composer require typo3/cms-dashboard:13.4.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that the security.backend.enforceReferrer feature is enabled and configure the BE/cookieSameSite setting to 'strict' to mitigate the risk of CSRF attacks until the package can be updated.
Conclusion
The CVE-2024-55920 vulnerability in the TYPO3 cms-dashboard package poses a significant risk due to its susceptibility to CSRF attacks. It is crucial for users to update to the latest patched versions to safeguard their systems. Implementing the recommended workarounds can provide temporary relief until the updates are applied.
See every vulnerability recorded for typo3/cms-dashboard →
FAQ
CVE-2024-55920 is a vulnerability in the TYPO3 cms-dashboard package that allows Cross-Site Request Forgery (CSRF) attacks, enabling unauthorized manipulation of the dashboard configuration.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
If exploited, this vulnerability can allow attackers to change the dashboard settings of the TYPO3 backend, potentially leading to unauthorized access or data manipulation.
You can update the package using Composer by running the command: composer require typo3/cms-dashboard:^10.4.48 or the appropriate version for your installation.
If immediate updates are not possible, enable the security.backend.enforceReferrer feature and set BE/cookieSameSite to 'strict' as a temporary workaround to reduce the risk of CSRF attacks.
