Stored XSS in Concrete CMS via Block Design CSS

Executive Summary

Concrete CMS versions below 9.5.3 are vulnerable to stored cross-site scripting (XSS) due to improper sanitization of custom style values in the Block Design dialog. These values are written into page CSS via a DOM sink, allowing malicious scripts to be stored and executed when an administrator views the page. An editor-level user could exploit this to run scripts in an administrator's session and potentially escalate privileges.

Useful 0 Not Useful 0

Detection Guidance

Check Concrete CMS version with: grep -r '"version"' /path/to/concrete/config/install/ or via admin panel. Look for custom style values in Block Design dialogs that may contain script tags or unusual CSS. Review page CSS files for injected scripts.

Useful 0 Not Useful 0

Impact Analysis

If you are an administrator or user with access to Concrete CMS, this vulnerability could allow an attacker with editor-level access to inject malicious scripts. These scripts could then execute in your browser session, potentially leading to unauthorized actions, data theft, or privilege escalation within the CMS.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, which may violate compliance requirements under GDPR (data protection) or HIPAA (health information privacy). Stored XSS attacks could expose sensitive user data, resulting in legal penalties, reputational damage, and loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Concrete CMS to version 9.5.3 or later immediately. Remove any suspicious custom styles in Block Design dialogs. Audit user roles to ensure only trusted editors can access design features. Monitor admin sessions for unusual activity.

Useful 0 Not Useful 0