Authorization Bypass in Bludit CMS 3.22.0

Executive Summary

Bludit CMS through version 3.22.0 has an authorization bypass flaw. Authenticated users with the Author role can exploit unprotected AJAX endpoints to enumerate and delete media files belonging to other users, including administrators. This is done by supplying arbitrary UUID parameters to endpoints like content-get-list, list-images, and delete-image.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check for unauthorized access to media files by monitoring network traffic for POST requests to bl-kernel/ajax/list-images and bl-kernel/ajax/delete-image endpoints. Authenticated users with Author roles should not access files outside their own pages. Review server logs for suspicious UUID parameter usage in these endpoints.

Useful 0 Not Useful 0

Impact Analysis

If you use Bludit CMS version 3.22.0 or earlier, an attacker with Author role access could delete your media files, including those on admin pages. This could disrupt website functionality, cause data loss, or lead to unauthorized content removal without proper permissions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data deletion or access, potentially violating GDPR's integrity principle or HIPAA's access controls. Organizations may face compliance violations if sensitive media files are compromised or deleted without authorization.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Bludit CMS to the latest version beyond 3.22.0. Restrict Author role permissions to prevent enumeration of page UUIDs via the content-get-list endpoint. Implement strict access controls on AJAX endpoints to enforce IMAGE_RESTRICT isolation. Monitor for unauthorized file deletions or access attempts.

Useful 0 Not Useful 0