Concrete CMS version 9 below 9.4.0RC2 and versions below 8.5.20 - CSRF and XSS in Concrete CMS Custom Address attribute

Vulnerability

Overview

Concrete CMS versions below 9.4.0RC2 and 8.5.20 are vulnerable to cross-site request forgery (CSRF) and stored cross-site scripting (XSS) in the Address attribute. The root cause is improper sanitization of address output when no country is specified, allowing an attacker to inject malicious scripts or forge requests. This issue affects both version 9.x (below 9.4.0RC2) and version 8.x (below 8.5.20) [1][4].

Exploitation

Conditions

An attacker must have the ability to fill in an address attribute, which is granted by a site administrator. The attack vector is network-based, requires low privileges (PR:L), and low user interaction (UI:P) according to the CVSS v4.0 vector. The attack complexity is low (AC:L) and no advanced techniques are needed. Exploitation can target the dashboard page, potentially rendering it unavailable [4].

Impact

Successful exploitation allows an attacker to glean limited information from the site, perform limited data modification, and cause denial of service to the dashboard page. The CVSS v4.0 score is 5.1 (medium), reflecting low impacts on confidentiality, integrity, and availability [4].

Mitigation

The vulnerability is fixed in Concrete CMS versions 9.4.0RC2 and 8.5.20. However, the fix only sanitizes new data uploaded after the update; existing database entries from before the update may still contain malicious payloads. Administrators are advised to update immediately and perform a database search to clean any previously injected exploits. The pull requests for the fix are available for version 9 and version 8 [1][2][3][4].