Concrete CMS Remote Code Execution Vulnerability in Express Entry List Block Controller

A remote code execution vulnerability exists in Concrete CMS versions 9.5.0 and prior, due to insecure deserialization in the Express Entry List block controller. A rogue administrator with the ability to add blocks can exploit this vulnerability by bypassing the protection mechanism that normally restricts malicious inputs. This is achieved through the REST API, which parses requests in a way that allows the injection of harmful serialized payloads into the block's filterFields database column. Once the payload is injected, it is executed when the block is viewed or edited by an administrator, potentially leading to a complete server takeover.

Impact

Exploitation of this vulnerability allows for remote code execution on the server.

Remediation

Users can upgrade to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.