Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries Vulnerabilities
• Software Link:
• Affected Versions:
Version 5.7.3.1 and probably other versions.
• Vulnerabilities Description:
Concrete5 implements a Synchronizer Token Pattern in order to provide anti-CSRF capabilities. However, the application fails to properly use this feature in every block or dashboard page which makes a system state change, such as settings modification. As a result, the application is vulnerable to some Cross-Site Request Forgery (CSRF) attacks:
-
File Manager – Delete: an attacker might force an authenticated user to delete files from the File Manager by tricking the victim into browsing to a specially crafted web page.
-
Public Registration Settings: an attacker might force an authenticated user to change the Public Registration Settings by tricking the victim into browsing to a specially crafted web page.
-
Public Profiles Settings: an attacker might force an authenticated user to change the Public Profiles Settings by tricking the victim into browsing to a specially crafted web page.
-
Authentication Types Settings: an attacker might force an authenticated user to enable or disable an authentication type, or change its settings by tricking the victim into browsing to a specially crafted web page.
-
Community Points: an attacker might force an authenticated user to assign points to arbitrary users, or add, delete, and edit Community Points Actions by tricking the victim into browsing to a specially crafted web page.
-
Translation Site Interface: an attacker might force an authenticated user to save arbitrary translation strings by tricking the victim into browsing to a specially crafted web page.
-
Add / Remove Group: an attacker might force an authenticated user to add/remove an arbitrary user to/from a group by tricking the victim into browsing to a specially crafted web page.
-
Community Connect: an attacker might force an authenticated user to change tokens used to connect to the marketplace by tricking the victim into browsing to a specially crafted web page.
• Solution:
Update to a fixed version.
• Disclosure Timeline:
[05/05/2015] – Vulnerabilities details sent through HackerOne
[02/10/2015] – CVE number requested
[28/12/2015] – Vendor said the vulnerabilities should be fixed in the upstream
[26/06/2016] – Vulnerabilities publicly disclosed on HackerOne
[28/06/2016] – Publication of this advisory
• CVE Reference:
The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a CVE identifier for these vulnerabilities.
• Credits:
Vulnerabilities discovered by Egidio Romano.