Concrete CMS Cross-Site Request Forgery Vulnerability in Core Update Process

A Cross-Site Request Forgery (CSRF) vulnerability has been identified in Concrete CMS versions through 9.5.0. The issue arises because the application emits a CSRF token in the 'local_available_update.php' view, but the corresponding 'do_update()' method in the update controller does not validate this token. As a result, an attacker can craft a cross-site POST request that triggers a core CMS update to a version specified by the attacker. For exploitation, the victim must have the 'canUpgrade()' permission, and a valid update version must be available under 'DIR_CORE_UPDATES'.

Impact

Exploitation of this vulnerability allows for unauthorized core CMS updates, potentially leading to other vulnerabilities being exploited or causing issues with the site's functionality.

Remediation

Users can update to Concrete CMS version 9.5.1 or later, where this vulnerability has been fixed.