CVE-2020-18879
📋 TL;DR
CVE-2020-18879 is an unrestricted file upload vulnerability in Bludit CMS v3.8.1 that allows remote attackers to upload malicious files via the upload-logo.php component. This can lead to arbitrary code execution on the server. All Bludit installations running vulnerable versions are affected.
💻 Affected Systems
- Bludit CMS
📦 What is this software?
Bludit by Bludit
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with remote code execution, data theft, and complete system control.
Likely Case
Webshell deployment leading to data exfiltration, defacement, or lateral movement within the network.
If Mitigated
File upload blocked or sanitized, preventing malicious file execution.
🎯 Exploit Status
Exploit requires no authentication and is trivial to execute via HTTP POST requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.9.0 and later
Vendor Advisory: https://github.com/bludit/bludit/issues/1011
Restart Required: No
Instructions:
1. Backup your Bludit installation. 2. Download the latest version from bludit.com. 3. Replace all files except the /bl-content/ directory. 4. Verify the update via the admin panel.
🔧 Temporary Workarounds
Block upload-logo.php access
allRestrict access to the vulnerable component via web server configuration.
# For Apache: add to .htaccess
<Files "upload-logo.php">
Order allow,deny
Deny from all
</Files>
# For Nginx: add to server block
location ~ /bl-kernel/ajax/upload-logo\.php$ {
deny all;
return 403;
}
Disable file uploads globally
allConfigure Bludit to disable all file uploads via admin panel.
Login to Bludit admin > Settings > Security > Disable file uploads
🧯 If You Can't Patch
- Implement strict WAF rules to block requests to upload-logo.php
- Monitor file system for unexpected PHP file creations in upload directories
🔍 How to Verify
Check if Vulnerable:
Check if /bl-kernel/ajax/upload-logo.php exists and accepts file uploads without validation.Check Version:
Check Bludit admin panel dashboard or view /bl-kernel/boot/version.phpVerify Fix Applied:
Verify version is v3.9.0+ and test that upload-logo.php rejects malicious file uploads.📡 Detection & Monitoring
Log Indicators:
- HTTP POST requests to /bl-kernel/ajax/upload-logo.php with file uploads
- Unexpected PHP file creation in upload directories
Network Indicators:
- POST requests to upload-logo.php with executable file extensions
SIEM Query:
source="web_logs" AND uri="/bl-kernel/ajax/upload-logo.php" AND method="POST"