HighGHSA-6xc4-7fmm-65q2CVE-2022-21829

Code injection in concrete CMS

Published 25 Jun 2022 · Updated 8 Nov 2023

Affected packages

concrete5/coreComposer

Affected: >=9.0.0 <9.1.0
Fixed in: 9.1.0

Update to the fixed version for your release line, for example:composer require concrete5/core:^9.1.0

concrete5/coreComposer

Affected: <8.5.8
Fixed in: 8.5.8

Update to the fixed version for your release line, for example:composer require concrete5/core:^8.5.8

Details

Concrete CMS Versions 9.0.0 through 9.0.2 and 8.5.7 and below can download zip files over HTTP and execute code from those zip files which could lead to an RCE. Fixed by enforcing ‘concrete_secure’ instead of ‘concrete’. Concrete now only makes requests over https even a request comes in via http. Concrete CMS security team ranked this 8 with CVSS v3.1 vector: AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H Credit goes to Anna for reporting HackerOne 1482520.

Is GHSA-6xc4-7fmm-65q2 in any of your client repos?

Checking one package by hand is fine. Checking it across forty client projects is not. NPMscan reads the lockfiles in every GitHub repo you pick, finds each project with an affected concrete5/core, and gives you the command that fixes it.

Scan a project free, no signup Or connect GitHub to scan every repo

References

Advisory data from OSV.dev (opens OSV.dev in a new tab), refreshed daily.