PT-2022-20008 · Concrete · Concrete

Siebene · Published 2022-06-24 · Updated 2022-07-05 · CVE-2022-30117

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions Concrete versions 8.5.7 and below Concrete versions 9.0 through 9.0.2

Description The issue allows traversal in /index.php/ccm/system/file/upload which could result in an Arbitrary File Delete exploit. This was remediated by sanitizing /index.php/ccm/system/file/upload to ensure Concrete doesn’t allow traversal and by changing isFullChunkFilePresent to have an early false return when input doesn't match expectations.

Recommendations For Concrete versions 8.5.7 and below, update to a version above 8.5.7 to resolve the issue. For Concrete versions 9.0 through 9.0.2, update to a version above 9.0.2 to resolve the issue. As a temporary workaround, consider restricting access to the /index.php/ccm/system/file/upload endpoint until a patch is available. Restrict input to the isFullChunkFilePresent function to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2022-30117

GHSA-3JXH-6635-6JWP

Affected Products

Concrete

References · 8

• https://documentation.concretecms.org/developers/introduction/version-history/858-release-notes · Vendor Advisory
• https://documentation.concretecms.org/developers/introduction/version-history/910-release-notes · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-30117 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-30117 · Security Note
• https://osv.dev/vulnerability/GHSA-3jxh-6635-6jwp · Vendor Advisory
• https://github.com/concretecms/concretecms-core · Note
• https://hackerone.com/reports/1482280 · Note
• https://t.me/cibsecurity/45089 · Telegram Post