Concrete CMS Unauthorized File Access Vulnerability in Download Controller

A vulnerability in Concrete CMS versions through 9.5.0 allows unauthorized access to files through the `submit_password()` method in the download file controller. The issue arises because the permission check for downloading files is improperly implemented. Files that are password-protected can be downloaded by any user who knows the password, regardless of their permission to access the file. Additionally, files without passwords can be downloaded freely. This vulnerability bypasses the `view_file` permission check, leading to unauthorized file access.

Impact

Exploitation of this vulnerability allows unauthorized users to access and download files that are supposed to be permission-restricted. This includes bypassing password protections on certain files, as long as the user knows the file's password.

Remediation

Users should upgrade to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.