PT-2023-29287 · Unknown · Concrete Cms

Romanhu · Published 2023-10-10 · Updated 2024-08-02 · CVE-2023-44763

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Concrete CMS version 9.2.1

Description The issue allows for Arbitrary File Upload via a Thumbnail file upload, which can lead to Cross-Site Scripting (XSS). This is possible even with the default configuration, where 'pdf' is one of the allowed file types, despite the vendor's stance that customers should exclude 'pdf' from allowed file types.

Recommendations For Concrete CMS version 9.2.1, consider excluding 'pdf' from the allowed file types in the configuration to mitigate the risk of Arbitrary File Upload and subsequent Cross-Site Scripting (XSS) attacks. As a temporary workaround, restrict the use of the Thumbnail file upload feature until a proper fix is applied.

Exploit

Fix

XSS

Unrestricted File Upload

Weakness Enumeration

CWE-79

CWE-434

Related Identifiers

CVE-2023-44763

GHSA-WRP2-6V6J-HFMG

Affected Products

Concrete Cms

References · 8

• 🔥 https://github.com/sromanhu/ConcreteCMS-Arbitrary-file-upload-Thumbnail · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2023-44763 · Security Note
• https://osv.dev/vulnerability/CVE-2023-44763 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wrp2-6v6j-hfmg · Vendor Advisory
• https://github.com/concretecms/concretecms · Note
• https://web.archive.org/web/20231026034159/https://documentation.concretecms.org/user-guide/editors-reference/dashboard/system-and-maintenance/files/allowed-file-types · Note
• https://t.me/cibsecurity/71929 · Telegram Post
• https://concretecms.org/about/project-news/security/security-advisory-2023-10-25-concrete-cms-rejects-cve-2023-44763 · Note