CVE-2020-24986
📋 TL;DR
This vulnerability allows authenticated attackers to upload PHP files through Concrete5's File Manager by modifying site configuration. Successful exploitation leads to remote code execution on the web server. All Concrete5 installations up to version 8.5.2 are affected.
💻 Affected Systems
- Concrete5 CMS
📦 What is this software?
Concrete Cms by Concretecms
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, malware deployment, or use as attack platform
Likely Case
Webshell installation allowing persistent backdoor access and data exfiltration
If Mitigated
File upload blocked or PHP execution prevented in upload directories
🎯 Exploit Status
Exploit requires authenticated access but is straightforward once access is obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.5.3 and later
Vendor Advisory: https://documentation.concretecms.org/developers/introduction/version-history/853-release-notes
Restart Required: No
Instructions:
1. Backup your Concrete5 installation and database. 2. Download Concrete5 version 8.5.3 or later. 3. Replace all files with the new version. 4. Run the update script if prompted.
🔧 Temporary Workarounds
Restrict PHP execution in upload directories
allAdd .htaccess rules to prevent PHP execution in upload directories
Add to .htaccess in upload directories: <FilesMatch "\.php$">
Order Allow,Deny
Deny from all
</FilesMatch>
Implement file type validation
allAdd server-side validation to block PHP file uploads
🧯 If You Can't Patch
- Restrict File Manager access to trusted administrators only
- Implement web application firewall rules to block PHP file uploads
🔍 How to Verify
Check if Vulnerable:
Check Concrete5 version in admin dashboard or via /concrete/config/concrete.phpCheck Version:
grep "APP_VERSION" /path/to/concrete/config/concrete.phpVerify Fix Applied:
Confirm version is 8.5.3 or higher and test PHP file upload is blocked📡 Detection & Monitoring
Log Indicators:
- PHP file uploads via File Manager
- Configuration modification attempts
- Unusual file creation in upload directories
Network Indicators:
- POST requests with PHP file uploads to File Manager endpoints
SIEM Query:
source="web_logs" AND (uri_path="/index.php/dashboard/system/files/uploads" OR uri_path="/index.php/dashboard/files/search") AND (file_extension="php" OR file_type="application/x-php")