CyberRota Analysis
AI-GeneratedConcrete CMS versions 9 through 9.5.2 are vulnerable to Server-Side Template Injection (SSTI) due to unvalidated style values in the Theme Customizer, allowing users with customization permissions to inject arbitrary LESS directives. This can lead to the exposure of sensitive information, such as database credentials and private keys, through publicly accessible CSS caches, as well as potential server-side request forgery. Organizations using affected versions of Concrete CMS should prioritize patching this vulnerability to mitigate risks associated with unauthorized data access and exploitation.
Original NVD Description
Concrete CMS 9 through 9.5.2 is vulnerable to Server-Side Template Injection (SSTI) in Theme Customizer via Unvalidated Style Values. Values submitted through the customizer (color channels and other style properties handled by ColorStyle and sibling Style classes such as FontFamilyStyle and ImageStyle) are interpolated into server-compiled LESS source without neutralization of LESS syntax, allowing a user with the Theme Customization permission to inject arbitrary LESS directives. By injecting the @import (inline) directive, an attacker can read arbitrary files on the server and reach internal network resources through PHP stream wrappers. The compiled output, including any disclosed file contents, is written to the site's publicly served CSS cache, exposing database credentials, private keys, and other application secrets, and enabling server-side request forgery. The Concrete CMS security team gave this vulnerability a CVSS v4.0 score of 5.9 with vector CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N. Thanks Yonatan Drori from Tenzai for reporting.