PT-2021-15303 · Unknown · Concrete Cms
Byc_404
·
Published
2021-11-19
·
Updated
2023-06-30
·
CVE-2021-22968
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Concrete CMS versions 8.5.6 and below
Description
A bypass in the Concrete CMS File Manager leads to remote code execution. The external file upload feature stages files in the public directory even if they have disallowed file extensions, storing them in a directory with a random name that can be brute-forced. An admin with file upload capabilities can exploit this to upload restricted file types and execute them, depending on server configuration.
Recommendations
To fix this issue, update to Concrete CMS version 9.0.0 or later, which includes a check for allowed file extensions before downloading files to a tmp directory.
As a temporary workaround, consider restricting access to the file upload feature to minimize the risk of exploitation.
Exploit
Fix
RCE
Unrestricted File Upload
Use of Insufficiently Random Values
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Concrete Cms