CVE-2024-3180: Concrete CMS Stored XSS in blocks of type file
Summary
CVE-2024-3180: Concrete CMS Stored XSS in blocks of type file. Affects concrete5/concrete5 across 2 version ranges.
< 8.5.16
>= 9.0.0RC1, < 9.2.8
Fixed in 8.5.16 or 9.2.8, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Concrete CMS is an open-source content management system that allows users to create and manage websites. It provides various features and functionalities for website development, including the ability to create different types of blocks. One of these block types is the file block, which allows administrators to add files to their websites. However, versions of Concrete CMS prior to 9.2.8 and 8.5.16 are vulnerable to a stored cross-site scripting (XSS) attack in blocks of type file.
Vulnerability Detail
The vulnerability in Concrete CMS allows a rogue administrator to inject malicious code into the link-text field when creating a block of type file. This stored XSS vulnerability can be exploited to execute arbitrary JavaScript code in the context of other users who view the affected page. The impact of this vulnerability can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the user. The Concrete CMS security team has assigned a CVSS v3.1 score of 3.1 to this vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 8.5.168.5.16composer require concrete5/concrete5:8.5.16 -
>= 9.0.0RC1, < 9.2.89.2.8composer require concrete5/concrete5:9.2.8
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can disable the use of file blocks or restrict access to the Concrete CMS administration panel to trusted users only. This can help mitigate the risk of exploitation until the software is updated to a secure version.
Conclusion
Concrete CMS versions prior to 9.2.8 and 8.5.16 are vulnerable to a stored XSS attack in blocks of type file. It is important for administrators to update their installations to the latest secure versions and follow best practices for securing their Concrete CMS websites. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for concrete5/concrete5 →
FAQ
Concrete CMS is an open-source content management system used for creating and managing websites.
A stored XSS vulnerability allows an attacker to inject malicious code that is permanently stored on a target website or application. This code is then executed when other users access the affected page, potentially leading to unauthorized actions or data theft.
An attacker with administrator privileges can add malicious code to the link-text field when creating a file block in Concrete CMS. When other users view the affected page, the injected code is executed in their browsers, allowing the attacker to perform various malicious actions.
The impact of this vulnerability can vary depending on the attacker's intentions. It can range from stealing sensitive information, such as login credentials, to performing actions on behalf of the user, potentially leading to unauthorized access or data manipulation.
To protect your Concrete CMS installation, it is crucial to keep the software up to date by applying the latest security patches. Additionally, it is recommended to restrict access to the administration panel to trusted users only and regularly monitor for any suspicious activity.
References
Related vulnerabilities
Recent vulnerabilities recorded for concrete5/concrete5.
