Description

Concrete CMS Community Store before 2.7.8 derives digital product download tokens from order creation timestamps instead of random values, making tokens predictable. Unauthenticated attackers can enumerate sequential order and file identifiers to calculate valid download tokens and retrieve digital goods purchased by other customers.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-22T16:18:18.607Z",
  "pubdate": "2026-09-22T16:18:18.607Z",
  "executiveSummary": "Concrete CMS Community Store versions prior to 2.7.8 suffer from a critical cryptographic weakness involving insecure generation of digital download tokens.\nThe vulnerability originates from the use of deterministic data—specifically order creation timestamps—rather than cryptographically secure pseudo-random numbers (CSPRNG) to derive tokens for digital assets.\nThis design flaw allows unauthenticated, remote attackers to perform sequence enumeration and brute-force attacks against the token generation algorithm.\nBy predicting valid tokens, unauthorized parties can bypass purchase authorization checks to gain unauthorized access to digital goods belonging to other customers.\nThe risk profile is high, as the exploitation requires no authentication or special privileges, effectively exposing sensitive merchant data and proprietary digital inventory to unauthorized exfiltration.\nThis vulnerability compromises the integrity and confidentiality of the Community Store's digital distribution mechanism.",
  "technicalDetails": "The root cause of this vulnerability lies in the improper implementation of token generation logic within the Community Store package for Concrete CMS.\nInstead of utilizing a high-entropy source of randomness, the application generates download tokens based on the order creation timestamp. Because timestamps are inherently sequential and predictable, the resulting token space is significantly limited and susceptible to calculation.\nExploitation follows a methodical process of enumeration. An attacker can first identify or estimate the target order ID or file identifier. By correlating these known identifiers with the predictable timestamp-based generation algorithm, the attacker can iteratively derive the valid tokens required to authorize a download.\nThe attack flow proceeds as follows: First, the attacker observes the application's behavior when processing valid digital goods downloads to understand the token structure. Second, the attacker harvests public or sequential order IDs and corresponding metadata. Third, the attacker leverages the time-sensitive nature of the token generation to compute the specific token string for a target order. Finally, the attacker crafts an HTTP request using the calculated token to the download endpoint, effectively masquerading as a legitimate customer.\nThe vulnerability is present in versions of Community Store prior to 2.7.8. It is accessible via the network to any unauthenticated remote attacker, as the download retrieval endpoint does not implement adequate server-side validation to ensure that the token was generated via a secure process or is cryptographically bound to the session of the purchasing user.\nPost-exploitation impact includes the unauthorized acquisition of digital products, resulting in direct revenue loss for the merchant, potential breach of customer data privacy, and unauthorized redistribution of proprietary or licensed assets. The lack of randomness renders traditional signature-based detection ineffective, as the attack vectors appear as legitimate requests originating from valid download URLs."
}