MEDIUM

GHSA-gqpw-9q54-9x28

Server-Side Request Forgery in Concrete CMS

Quick fix

GHSA-gqpw-9q54-9x28 — concrete5/core: upgrade to the fixed version with the command below.

composer require concrete5/core:^8.5.7

Details

Concrete CMS (formerly concrete5) versions 8.5.6 and below and version 9.0.0 allow local IP importing causing the system to be vulnerable to SSRF attacks on the private LAN to servers by reading files from the local LAN. An attacker can pivot in the private LAN and exploit local network appsandb.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/concrete5/core

Introduced in: 0Fixed in: 8.5.7

Fixcomposer require concrete5/core:^8.5.7

References

https://nvd.nist.gov/vuln/detail/CVE-2021-22970[ADVISORY]
https://hackerone.com/reports/1364797[WEB]
https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes[WEB]
https://documentation.concretecms.org/developers/introduction/version-history/901-release-notes[WEB]