-------------------------------------------------------------------------- Concrete5 <= 5.7.3.1 Multiple Cross-Site Request Forgeries Vulnerabilities -------------------------------------------------------------------------- [-] Software Link: https://www.concrete5.org/ [-] Affected Versions: Version 5.7.3.1 and probably other versions. [-] Vulnerabilities Description: Concrete5 implements a Synchronizer Token Pattern in order to provide anti-CSRF capabilities. However, the application fails to properly use this feature in every block or dashboard page which makes a system state change, such as settings modification. As a result, the application is vulnerable to some Cross-Site Request Forgery (CSRF) attacks: 1) File Manager - Delete: an attacker might force an authenticated user to delete files from the File Manager by tricking the victim into browsing to a specially crafted web page. 2) Public Registration Settings: an attacker might force an authenticated user to change the Public Registration Settings by tricking the victim into browsing to a specially crafted web page. 3) Public Profiles Settings: an attacker might force an authenticated user to change the Public Profiles Settings by tricking the victim into browsing to a specially crafted web page. 4) Authentication Types Settings: an attacker might force an authenticated user to enable or disable an authentication type, or change its settings by tricking the victim into browsing to a specially crafted web page. 5) Community Points: an attacker might force an authenticated user to assign points to arbitrary users, or add, delete, and edit Community Points Actions by tricking the victim into browsing to a specially crafted web page. 6) Translation Site Interface: an attacker might force an authenticated user to save arbitrary translation strings by tricking the victim into browsing to a specially crafted web page. 7) Add / Remove Group: an attacker might force an authenticated user to add/remove an arbitrary user to/from a group by tricking the victim into browsing to a specially crafted web page. 8) Community Connect: an attacker might force an authenticated user to change tokens used to connect to the marketplace by tricking the victim into browsing to a specially crafted web page. [-] Solution: Update to a fixed version. [-] Disclosure Timeline: [05/05/2015] - Vulnerabilities details sent through HackerOne [02/10/2015] - CVE number requested [28/12/2015] - Vendor said the vulnerabilities should be fixed in the upstream [26/06/2016] - Vulnerabilities publicly disclosed on HackerOne [28/06/2016] - Publication of this advisory [-] CVE Reference: The Common Vulnerabilities and Exposures project (cve.mitre.org) has not assigned a CVE identifier for these vulnerabilities. [-] Credits: Vulnerabilities discovered by Egidio Romano. [-] Original Advisory: http://karmainsecurity.com/KIS-2016-08 [-] Other References: https://hackerone.com/reports/59660