CyberRota Analysis
AI-GeneratedConcrete CMS versions 9.0.0 to 9.5.2 are susceptible to Server-Side Request Forgery (SSRF) due to improper handling of validated DNS pins, allowing low-privileged authenticated users to exploit this flaw. By manipulating remote file imports, attackers can trick the server into accessing internal resources, potentially exposing sensitive information or services. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access to internal systems.
Original NVD Description
Concrete CMS 9.0.0 to 9.5.2 is vulnerable to Server-Side Request Forgery iremote file import via cross-port reuse of a host's validated DNS pin. When multiple remote URLs share the same host, only the first `ValidatedRemoteUrl` is retained and reused for every later URL with that host. A low-privileged authenticated user permitted to import files could therefore supply a DNS-rebinding host that resolved to a public address during validation and to a private or loopback address during the unpinned download, causing the server to fetch internal-only resources such as loopback services, internal admin panels, or cloud metadata endpoints and to save the responses into the file manager. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 2.1 with vector CVSS:4.0/AV:N/AC:H/AT:P/PR:H/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N. Thanks Ahmad Wicaksono (sonix03) for reporting.