CVE-2021-36766
📋 TL;DR
This vulnerability allows attackers to inject malicious PHP objects into Concrete5 applications through deserialization of untrusted data. Attackers can exploit this to execute arbitrary PHP code on the server. All Concrete5 installations up to version 8.5.5 are affected.
💻 Affected Systems
- Concrete5 CMS
📦 What is this software?
Concrete Cms by Concretecms
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise leading to data theft, ransomware deployment, or complete system takeover.
Likely Case
Remote code execution allowing attackers to deface websites, steal sensitive data, or install backdoors.
If Mitigated
Limited impact with proper input validation and file system restrictions in place.
🎯 Exploit Status
Exploitation requires authenticated access to the dashboard, but public proof-of-concept code exists.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.5.6 and later
Vendor Advisory: https://documentation.concretecms.org/developers/introduction/version-history/855-release-notes
Restart Required: No
Instructions:
1. Backup your Concrete5 installation and database. 2. Download Concrete5 version 8.5.6 or later from the official website. 3. Replace all files with the new version. 4. Run any required database updates through the dashboard.
🔧 Temporary Workarounds
Disable phar:// stream wrapper
allPrevents exploitation by disabling the vulnerable stream wrapper
Add 'phar.readonly = 1' to php.ini
Input validation filter
allAdd input validation to block phar:// protocol in logFile parameter
Modify controllers/single_page/dashboard/system/environment/logging.php to validate input
🧯 If You Can't Patch
- Restrict dashboard access to trusted IP addresses only
- Implement web application firewall rules to block requests containing 'phar://'
🔍 How to Verify
Check if Vulnerable:
Check if Concrete5 version is 8.5.5 or earlier in dashboard/system/environment/infoCheck Version:
Check Concrete5 dashboard or view concrete/config/concrete.php version constantVerify Fix Applied:
Verify version is 8.5.6 or later and test that phar:// input is rejected📡 Detection & Monitoring
Log Indicators:
- POST requests to /dashboard/system/environment/logging/update_logging with phar:// in parameters
- Unusual file operations or PHP errors related to deserialization
Network Indicators:
- HTTP requests containing 'phar://' strings in POST data
SIEM Query:
web.url:*dashboard/system/environment/logging* AND web.post_data:*phar://*🔗 References
- http://packetstormsecurity.com/files/163564/Concrete5-8.5.5-Phar-Deserialization.html
- http://seclists.org/fulldisclosure/2021/Jul/36
- https://hackerone.com/reports/1063039
- http://packetstormsecurity.com/files/163564/Concrete5-8.5.5-Phar-Deserialization.html
- http://seclists.org/fulldisclosure/2021/Jul/36
- https://hackerone.com/reports/1063039
