CVE-2021-40101
📋 TL;DR
This vulnerability allows authenticated users in Concrete CMS to change their own or potentially other users' passwords without providing the current password. This affects all Concrete CMS installations before version 8.5.7 where users have access to the Dashboard interface.
💻 Affected Systems
- Concrete CMS
📦 What is this software?
Concrete Cms by Concretecms
⚠️ Risk & Real-World Impact
Worst Case
An attacker with authenticated access could change administrator passwords, take over the CMS, and potentially compromise the entire web application and underlying server.
Likely Case
Malicious users or compromised accounts could change passwords to maintain persistent access, escalate privileges, or lock out legitimate users.
If Mitigated
With proper access controls and monitoring, impact is limited to unauthorized password changes that can be detected and reversed.
🎯 Exploit Status
Exploitation requires authenticated access but is trivial once authenticated. The HackerOne report demonstrates the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.5.7
Vendor Advisory: https://documentation.concretecms.org/developers/introduction/version-history/857-release-notes
Restart Required: No
Instructions:
1. Backup your Concrete CMS installation and database. 2. Update to Concrete CMS version 8.5.7 or later. 3. Verify the update completed successfully. 4. Test password change functionality to confirm current password is now required.
🔧 Temporary Workarounds
Disable user password changes
allTemporarily disable password change functionality for non-administrative users
Implement additional authentication
allAdd two-factor authentication or additional verification for password changes
🧯 If You Can't Patch
- Implement strict access controls to limit Dashboard access to trusted users only
- Monitor authentication logs for unusual password change activities
🔍 How to Verify
Check if Vulnerable:
Attempt to change a user password via Dashboard without providing current password. If successful, system is vulnerable.Check Version:
Check Concrete CMS version in admin panel or via concrete/bin/concrete5 c5:versionVerify Fix Applied:
After updating, attempt password change without current password should fail with appropriate error message.📡 Detection & Monitoring
Log Indicators:
- Multiple password change events for same user
- Password changes without current password verification
- Unusual password reset patterns
Network Indicators:
- POST requests to password change endpoints without current password parameter
SIEM Query:
source="concrete_cms" AND (event="password_change" OR event="user_update") AND NOT current_password_present