Vulnerability · Published Nov 19, 2021 · Assigned by hackerone
CVE-2021-22968
High 7.2
In plain English
A high-severity security flaw in https://github.com/concrete5/concrete5. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A bypass of adding remote files in Concrete CMS (previously concrete5) File Manager leads to remote code execution in Concrete CMS (concrete5) versions 8.5.6 and below.The external file upload feature stages files in the public directory even if they have disallowed file extensions. They are stored in a directory with a random name, but it's possible to stall the uploads and brute force the directory name. You have to be an admin with the ability to upload files, but this bug gives you the ability to upload restricted file types and execute them depending on server configuration.To fix this, a check for allowed file extensions was added before downloading files to a tmp directory.Concrete CMS Security Team gave this a CVSS v3.1 score of 5.4 AV:N/AC:H/PR:H/UI:R/S:C/C:N/I:H/A:NThis fix is also in Concrete version 9.0.0
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | concrete5/core | 8.5.7 | GHSA-g3p2-hfqr-9m25 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/concrete5/concrete5 | Concrete CMS version 9.0 and version 8.5.7 |
Weakness: CWE-98
References
- https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes x_refsource_MISC
- https://hackerone.com/reports/1350444 x_refsource_MISC