Bludit: Bludit v3.9.2 Code Execution Vulnerability in "Upload function"

[christasa]

A Code Execution Vulnerability in Bludit v3.9.2

Hi,
For CVE ID,so I open a new issue,sorry about that.And I think you haven't completely fixed the bug.

There is a new Code Execution Vulnerability which allow to get server permissions,the path is /bl-kernel/admin/ajax/upload-images.php

1, login with any account which allows you to edit conten

2.upload the evil jpg

We can specify the location of the uploaded file by changing the value of the uuid,then upload the evil picture to tmp folder

3.upload both the.htaccess file and the access target jpg

Successfully reverted to the target file

4. Access the evil file that are written through jpg

So I recommend checking the file before uploading it to temporary directory

[dignajar]

I uploaded a fix, checking if the uuid variable has a directory separator character.
Any other recommendation to prevent this ?

[christasa]

It can also to code execution by both accounts upload file at the same time,one of account to upload the .htaccess file,and the other upload the evil file.

My personal opinion is rename the file to random number before upload to temporary directory.

[dignajar]

I added check the extension file, if you can try to do the exploit with the version from Github. I will release a new version in a few days.

[christasa]

OK,glad to help you

[dignajar]

Fixed in Bludit v3.10.0.

[morgothqwe]

its too late but you dont even need to upload .htaccess or jpg
you can upload php file into server and may get some error that you cant upload such format but btw it will be upload to server and you can use that php file