Executive brief
Concrete CMS, a content management system, has a vulnerability in its remote file import feature that allows low-privileged authenticated users to bypass security controls through DNS rebinding. An attacker can trick the server into accessing and downloading sensitive internal resources (such as metadata endpoints, admin panels, or internal services) and save them into the file manager, potentially exposing confidential information or enabling further attacks.
Technical details
This is a Server-Side Request Forgery (SSRF) vulnerability in Concrete CMS's remote file import functionality. The root cause is improper DNS pinning validation: when multiple remote URLs share the same hostname, the system caches only the first ValidatedRemoteUrl and reuses it for all subsequent URLs with that host. An authenticated user with file import permissions can exploit this by supplying a DNS-rebinding hostname that resolves to a public address during validation but to a private or loopback address during the actual download, causing the server to fetch internal resources. The attacker can then save the responses (from services like cloud metadata endpoints, internal admin panels, or loopback services) into the file manager. The vulnerability requires authentication, DNS rebinding capability, and precise timing, making it moderately difficult but feasible to exploit.
Affected products
- Concrete CMS Concrete CMS 9.0.0 to 9.5.2
Timeline
- 2026-09-15: disclosed