## Summary
Concrete CMS 9.5.0 and below contains a CSRF weakness in install_package() in concrete/controllers/single_page/dashboard/extend/install.php. An attacker can leverage an authenticated administrator’s browser to trigger installation of a pre-positioned package, which executes the package’s install() method as the web server user, enabling remote code execution.
## Technical Details
- Vulnerable component: install_package() in concrete/controllers/single_page/dashboard/extend/install.php.
- Issue type: CSRF (CWE-352) due to missing CSRF protection for the package installation flow.
- Preconditions (as described):
- Attacker must be able to cause an authenticated administrator to visit a crafted page.
- A package must already exist (or be caused to exist) under DIR_PACKAGES/<handle>/.
- The victim must be passing canInstallPackages.
- Execution impact: package installation runs the package controller’s install() method as the web server user.
## Affected
- concretecms / concrete cms versions: < 9.5.1 (includes 9.5.0 and below).
## Impact
- Unauthenticated attacker does not directly exploit; exploitation requires an authenticated administrator to be tricked (CSRF).
- Successful exploitation can lead to remote code execution under the web server user context.
## Mitigation
1. Upgrade Concrete CMS to a version beyond 9.5.0 / >= 9.5.1 (per the stated affected range).
2. Ensure the admin interface is protected against CSRF (e.g., verify CSRF defenses for any package-install related endpoints and disable/limit package installation privileges where possible).
3. Reduce exposure of package installation by restricting canInstallPackages to only trusted administrators.
4. Monitor for unexpected package directories under DIR_PACKAGES/<handle>/ and investigate any anomalous package installation attempts.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CWE-352