CVE-2024-7394
📋 TL;DR
Concrete CMS versions 9 through 9.3.2 and below 8.5.18 contain a stored cross-site scripting (XSS) vulnerability in the getAttributeSetName() function. A rogue administrator can inject malicious JavaScript that executes when other users view affected pages. This affects all Concrete CMS installations with vulnerable versions and administrator accounts.
💻 Affected Systems
- Concrete CMS
📦 What is this software?
Concrete Cms by Concretecms
Concrete Cms by Concretecms
⚠️ Risk & Real-World Impact
Worst Case
A malicious administrator could steal session cookies, redirect users to phishing sites, or perform actions on behalf of authenticated users, potentially leading to account compromise or data theft.
Likely Case
A rogue administrator injects malicious scripts that execute in victims' browsers, potentially stealing session tokens or performing unauthorized actions within the CMS.
If Mitigated
With proper administrator vetting and monitoring, the impact is limited since exploitation requires administrative privileges.
🎯 Exploit Status
Exploitation requires administrative access to the Concrete CMS instance. The vulnerability is in the getAttributeSetName() function where input validation is insufficient.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Concrete CMS 9.3.3 or 8.5.18
Vendor Advisory: https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes
Restart Required: No
Instructions:
1. Backup your Concrete CMS installation and database. 2. Update to Concrete CMS 9.3.3 (for version 9.x) or 8.5.18 (for version 8.x). 3. Verify the update completed successfully. 4. Clear any CMS caches if applicable.
🔧 Temporary Workarounds
Input Sanitization Enhancement
allImplement additional input validation and output encoding for attribute set names
Not applicable - requires code modification
Administrator Access Restriction
allLimit administrator accounts to trusted personnel only and implement role-based access controls
Not applicable - configuration change
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to mitigate XSS impact
- Monitor administrator activities and audit logs for suspicious behavior
🔍 How to Verify
Check if Vulnerable:
Check your Concrete CMS version. If running version 9.0.0-9.3.2 or any version below 8.5.18, you are vulnerable.Check Version:
Check the Concrete CMS dashboard or examine the concrete/config/concrete.php file version constantVerify Fix Applied:
After updating, verify you are running Concrete CMS 9.3.3 or 8.5.18 or higher.📡 Detection & Monitoring
Log Indicators:
- Unusual administrator activity modifying attribute sets
- Suspicious JavaScript in attribute set names or database entries
Network Indicators:
- Unexpected outbound connections from CMS pages to external domains
SIEM Query:
source="concrete_cms_logs" AND (event="attribute_set_modified" OR event="admin_activity") AND (message="*script*" OR message="*javascript*")🔗 References
- https://documentation.concretecms.org/9-x/developers/introduction/version-history/933-release-notes?pk_vid=e367a434ef4830491723055753d52041
- https://documentation.concretecms.org/developers/introduction/version-history/8518-release-notes?pk_vid=e367a434ef4830491723055758d52041
- https://github.com/concretecms/concretecms/commit/c08d9671cec4e7afdabb547339c4bc0bed8eab06
- https://github.com/concretecms/concretecms/pull/12166
