CVE-2021-40108
📋 TL;DR
This CSRF vulnerability in Concrete CMS allows attackers to trick authenticated users into unknowingly adding malicious calendar events. Attackers can create fake events that could contain malicious links or content. All Concrete CMS installations up to version 8.5.5 are affected.
💻 Affected Systems
- Concrete CMS
📦 What is this software?
Concrete Cms by Concretecms
⚠️ Risk & Real-World Impact
Worst Case
Attackers could create calendar events containing malicious links that lead to phishing sites, malware downloads, or further attacks against users who interact with the events.
Likely Case
Attackers create spam or malicious calendar events that could trick users into visiting harmful websites or disclosing sensitive information.
If Mitigated
With proper CSRF protections, attackers cannot force users to create unauthorized calendar events, limiting impact to user education about suspicious calendar entries.
🎯 Exploit Status
CSRF attacks are well-understood and easy to implement; requires user interaction but no special technical skills.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 8.5.6
Vendor Advisory: https://documentation.concretecms.org/developers/introduction/version-history/856-release-notes
Restart Required: No
Instructions:
1. Backup your Concrete CMS installation and database. 2. Download Concrete CMS 8.5.6 or later. 3. Replace existing files with patched version. 4. Clear cache if applicable.
🔧 Temporary Workarounds
Implement CSRF Protection Middleware
allAdd custom middleware to verify ccm_token on vulnerable endpoint
Implement token verification in application/concrete/src/Controller/Calendar/Dialogs/Event/AddController.php
🧯 If You Can't Patch
- Restrict calendar event creation permissions to trusted administrators only
- Implement web application firewall rules to block CSRF attempts to the vulnerable endpoint
🔍 How to Verify
Check if Vulnerable:
Check if Concrete CMS version is 8.5.5 or earlier in admin dashboard or by examining version filesCheck Version:
Check concrete/config/concrete.php or admin dashboard version displayVerify Fix Applied:
Verify installation is version 8.5.6 or later and test that ccm_token verification is enforced on /ccm/calendar/dialogs/event/add/save endpoint📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /ccm/calendar/dialogs/event/add/save without valid ccm_token
- Calendar event creation from unexpected IP addresses or user agents
Network Indicators:
- CSRF attack patterns with missing or invalid anti-CSRF tokens
- Requests to vulnerable endpoint from external referrers
SIEM Query:
source="web_logs" AND uri="/ccm/calendar/dialogs/event/add/save" AND (NOT ccm_token=* OR ccm_token="")