CVE-2024-1246: Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature
Summary
CVE-2024-1246: Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature. Affects concrete5/concrete5 versions >= 9.0.0RC1, < 9.2.5. Fixed in 9.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is a content management system that is used to build and manage websites. It provides various features for administrators to import and manage images on the website. However, in versions prior to 9.2.5, Concrete CMS is vulnerable to reflected cross-site scripting (XSS) attacks through the Image URL Import Feature. This vulnerability arises due to insufficient validation of user-provided data by administrators. An attacker with administrator privileges could inject malicious code during the image import process, leading to the execution of the code on the website user's browser. This vulnerability does not affect versions of Concrete CMS prior to version 9.
Vulnerability Detail
The vulnerability in Concrete CMS allows a rogue administrator to exploit the Image URL Import Feature and inject malicious code into the website. This code is then executed on the browsers of website users, potentially leading to various attacks such as session hijacking, defacement, or theft of sensitive information. The Concrete CMS Security team has assigned a CVSS v3 score of 2.0 to this vulnerability, indicating a low severity level.
How To Fix
Minimum fixed version
9.2.5
This is the first release that contains the fix.
composer require concrete5/concrete5:9.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the Image URL Import Feature until the CMS is updated to a secure version. This can be done by modifying the CMS configuration or disabling the corresponding functionality through the administrative interface. By disabling this feature, the risk of exploitation through the vulnerability is mitigated.
Conclusion
Concrete CMS versions prior to 9.2.5 are vulnerable to reflected XSS attacks through the Image URL Import Feature. It is crucial to update the CMS to the latest secure version or disable the vulnerable feature to protect the website and its users. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is a content management system used to build and manage websites.
The Image URL Import Feature in Concrete CMS allows administrators to import images into the website using URLs.
The vulnerability arises due to insufficient validation of user-provided data during the image import process.
An attacker with administrator privileges can inject malicious code that gets executed on the browsers of website users, potentially leading to various attacks.
Updating Concrete CMS to version 9.2.5 or later will patch the vulnerability. Alternatively, you can disable the Image URL Import Feature until the CMS is updated.
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
