PT-2021-15304 · Unknown · Concrete Cms

Adrian Tiron + 1 · Published 2021-11-19 · Updated 2021-11-23 · CVE-2021-22969

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS versions below 8.5.7 Concrete CMS version 9.0.0 is not affected as it includes the fix.

Description The issue concerns a SSRF mitigation bypass using a DNS Rebind attack, allowing an attacker to fetch cloud IAAS IAM keys. To address this, Concrete CMS no longer allows downloads from the local network and specifies the validated IP when downloading, rather than relying on DNS. A mitigation for this issue is to ensure IMDS configurations follow a cloud provider's best practices.

Recommendations For Concrete CMS versions below 8.5.7, update to version 8.5.7 or later to fix the issue. For users who cannot update immediately, consider implementing the mitigation by ensuring IMDS configurations are according to a cloud provider's best practices. As a temporary workaround, consider restricting downloads from the local network and specifying validated IPs when downloading to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2021-22969

GHSA-MCXR-FX5F-96QQ

Affected Products

Concrete Cms

References · 7

• https://osv.dev/vulnerability/CVE-2021-22969 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mcxr-fx5f-96qq · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22969 · Security Note
• https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes · Vendor Advisory
• https://t.me/cibsecurity/32734 · Telegram Post
• https://t.me/cvenotify/23665 · Telegram Post
• https://hackerone.com/reports/1369312 · Note