CVE-2023-48652: Concrete CMS Cross Site Request Forgery (CSRF)
Summary
CVE-2023-48652: Concrete CMS Cross Site Request Forgery (CSRF). Affects concrete5/concrete5 versions < 9.2.3. Fixed in 9.2.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is a content management system that allows users to create and manage websites. It provides a user-friendly interface and a range of features for website customization. However, Concrete CMS versions 9 before 9.2.3 are vulnerable to Cross Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to manipulate an authenticated admin user into unknowingly performing malicious actions, such as deleting server report logs.
Vulnerability Detail
The vulnerability in Concrete CMS arises from a lack of proper CSRF protection on the /ccm/system/dialogs/logs/delete_all/submit endpoint. By crafting a malicious request and tricking an admin user into visiting a specially crafted webpage or clicking on a malicious link, an attacker can force the user to unknowingly delete server report logs. This can lead to the loss of important log data and potentially disrupt the functioning of the web application.
How To Fix
Minimum fixed version
9.2.3
This is the first release that contains the fix.
composer require concrete5/concrete5:9.2.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by adding CSRF protection to the vulnerable endpoint manually. This can be achieved by implementing CSRF tokens and validating them on the server-side before processing any requests to delete server report logs.
Conclusion
Concrete CMS versions 9 before 9.2.3 are vulnerable to Cross Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to manipulate an authenticated admin user into unknowingly performing malicious actions, such as deleting server report logs. To mitigate this vulnerability, it is crucial to upgrade to Concrete CMS version 9.2.3 or later. Alternatively, implementing CSRF protection on the vulnerable endpoint can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is a content management system that allows users to create and manage websites. It provides a user-friendly interface and a range of features for website customization.
Cross Site Request Forgery (CSRF) is a type of attack where an attacker tricks an authenticated user into unknowingly performing malicious actions on a web application. In this case, the CSRF vulnerability in Concrete CMS allows an attacker to force an admin user to delete server report logs.
The CSRF vulnerability in Concrete CMS can lead to the loss of important log data and potentially disrupt the functioning of the web application. It can also be used as a stepping stone for further attacks, depending on the specific context and functionality of the application.
To fix this vulnerability, it is recommended to upgrade Concrete CMS to version 9.2.3 or later. This version includes the necessary patches to mitigate the CSRF vulnerability. Users should update their installations as soon as possible to ensure the security of their web applications.
If upgrading to the latest version is not immediately feasible, a temporary workaround can be implemented by adding CSRF protection to the vulnerable endpoint manually. This can be achieved by implementing CSRF tokens and validating them on the server-side before processing any requests to delete server report logs.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
