CVE-2022-21829

Vulnerability

Overview

CVE-2022-21829 is a remote code execution (RCE) vulnerability in Concrete CMS affecting versions 9.0.0 through 9.0.2 and 8.5.7 and earlier. The root cause is that the CMS could download ZIP files over unencrypted HTTP connections and subsequently execute code from those archives. The fix enforces the use of concrete_secure instead of concrete, ensuring that all requests are made over HTTPS even if the initial request arrives via HTTP [1][2].

Exploitation

Conditions

Exploitation requires high privileges (PR:H) and a complex attack (AC:H), but can be carried out over the network (AV:N) without user interaction (UI:N). An attacker with administrative access could trick the system into downloading a malicious ZIP file from an attacker-controlled HTTP server, leading to code execution. The vulnerability lies in the update or package download mechanism, which previously did not enforce HTTPS [2].

Impact

Successful exploitation grants the attacker remote code execution with high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). The scope is changed (S:C), meaning the compromise can affect resources beyond the vulnerable component, potentially leading to full site takeover [2].

Mitigation

The vulnerability is patched in Concrete CMS versions 9.1.0 and 8.5.8. Users running affected versions should upgrade immediately. The release notes for 9.1.0 [1] and 8.5.8 [3] include the security fix. No workarounds are documented; upgrading is the recommended action.