Bludit: XSS vulnerability in 'Links' plugin , need 'Blog X' theme to be active .

[zongdeiqianxing]

bludit v3.13.1 has a XSS vulnerability in 'Links' plugin , need 'Blog X' theme to be active . Attackers can use this vulnerability to execute js code .

1 open http://10.150.10.170/admin/configure-plugin/pluginLinks
insert 'javascript:alert('link - XSS')' into 'URL'

2 open http://10.150.10.170/set-up-your-new-site , click the 'XSS' link ,

[lightmat]

How is that an vulnerability?
You need admin rights to execute that. You should not add a user you don't trust to to the system, as Bludit does not distinguish between different user rights. All created users have admin rights.

[zongdeiqianxing]

It exists objectively, just use it require some conditions like admin rights as you said .

[lightmat]

Ok, but I think that it is out of scope in this context when Bludit as such does not support various user rights, nor is it intended to.

[clickwork-git]

Attackers can use this vulnerability to execute js code .

This is nonsense. You must have admin rights.

[ghost]

As @clickwork-git already mentioned on various other issues like this: You cannot do this without admin rights.

It exists objectively, just use it require some conditions like admin rights as you said .

I don't know any system, which cannot be destroyed by someone with admin rights (just mention the most popular ones):

• WordPress offers a Source Editor for Plugins and Themes (you can directly inject your own code)
• Drupal and Joomla allows uploading Plugins and Themes from the admin area
• Typo3 allows doing ... like EVERYTHING

The only good way to repair all this vulnerability is to outsource the admin area into a plugin, and disable it completely (also known as Headless CMS). And EVEN if you do this, you'll still have a vulnerability if someone hacks your FTP / SSH / WebDav Password.

You don't need to oversecure a system, you need to educate the people using it. Starting with the simplest task ever: Creating a secure password and if someone already fails on this point he still can use a password manager which - hopefully - doing it right.

[zongdeiqianxing]

I'm not here to prove that it is a vulnerability , I just remind you that there is a possibility of inserting js code by someone or someways and affecting users . If you think there is no risk, you can ignore it.