Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bludit v3.9.2 Code Execution Vulnerability in "Upload function" #1081

Closed
christasa opened this issue Sep 7, 2019 · 6 comments
Closed

Bludit v3.9.2 Code Execution Vulnerability in "Upload function" #1081

christasa opened this issue Sep 7, 2019 · 6 comments

Comments

@christasa
Copy link

A Code Execution Vulnerability in Bludit v3.9.2

Hi,
For CVE ID,so I open a new issue,sorry about that.And I think you haven't completely fixed the bug.

There is a new Code Execution Vulnerability which allow to get server permissions,the path is /bl-kernel/admin/ajax/upload-images.php

1, login with any account which allows you to edit conten

image

2.upload the evil jpg

We can specify the location of the uploaded file by changing the value of the uuid,then upload the evil picture to tmp folder
image
image

3.upload both the.htaccess file and the access target jpg

image
image

image
Successfully reverted to the target file

4. Access the evil file that are written through jpg

image

So I recommend checking the file before uploading it to temporary directory
dignajar added a commit that referenced this issue Sep 8, 2019
@dignajar
Bug fix for #1081
a9640ff
@dignajar
Copy link
Member

dignajar commented Sep 8, 2019

I uploaded a fix, checking if the uuid variable has a directory separator character.
Any other recommendation to prevent this ?

@christasa
Copy link
Author

It can also to code execution by both accounts upload file at the same time,one of account to upload the .htaccess file,and the other upload the evil file.
image

My personal opinion is rename the file to random number before upload to temporary directory.

@dignajar
Copy link
Member

I added check the extension file, if you can try to do the exploit with the version from Github. I will release a new version in a few days.

@christasa
Copy link
Author

OK,glad to help you

@dignajar dignajar mentioned this issue Sep 17, 2019
Closed
@dignajar
Copy link
Member

Fixed in Bludit v3.10.0.

@morgothqwe
Copy link

its too late but you dont even need to upload .htaccess or jpg
you can upload php file into server and may get some error that you cant upload such format but btw it will be upload to server and you can use that php file

@bludit bludit deleted a comment from tronghoang89 Oct 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@dignajar @morgothqwe @christasa