CVE-2020-20495
📋 TL;DR
CVE-2020-20495 is an arbitrary file deletion vulnerability in Bludit CMS v3.13.0's backup plugin. Attackers can delete any file on the server by manipulating the 'deleteBackup' parameter. This affects all Bludit installations running the vulnerable version with the backup plugin enabled.
💻 Affected Systems
- Bludit CMS
📦 What is this software?
Bludit by Bludit
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise via deletion of critical system files, leading to service disruption, data loss, or privilege escalation by deleting authentication files.
Likely Case
Website defacement or data loss through deletion of web application files, configuration files, or user content.
If Mitigated
Limited impact if proper file permissions restrict web user access to critical system files.
🎯 Exploit Status
Exploitation requires authentication to access the backup plugin functionality. Proof-of-concept available in GitHub issues.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: v3.13.1
Vendor Advisory: https://github.com/bludit/bludit/releases/tag/3.13.1
Restart Required: No
Instructions:
1. Download Bludit v3.13.1 or later from official repository. 2. Backup current installation. 3. Replace all files except /bl-content/ and /bl-plugins/ directories. 4. Verify functionality.
🔧 Temporary Workarounds
Disable Backup Plugin
linuxTemporarily disable the vulnerable backup plugin to prevent exploitation.
mv /path/to/bludit/bl-plugins/backup /path/to/bludit/bl-plugins/backup.disabled
Restrict Plugin Access
allUse web server configuration to block access to backup plugin endpoints.
# Apache: Add to .htaccess
<Files "backup.php">
Order Allow,Deny
Deny from all
</Files>
# Nginx: Add to server block
location ~* /admin/backup {
deny all;
}
🧯 If You Can't Patch
- Disable or remove the backup plugin entirely.
- Implement strict file permission controls to limit web user's ability to delete critical files.
🔍 How to Verify
Check if Vulnerable:
Check if running Bludit v3.13.0 and backup plugin exists in /bl-plugins/backup/ directory.Check Version:
cat /path/to/bludit/bl-kernel/boot/version.php | grep "define('BLUDIT_VERSION'"Verify Fix Applied:
Verify version is v3.13.1 or later via admin panel or checking version file.📡 Detection & Monitoring
Log Indicators:
- HTTP requests to /admin/backup with deleteBackup parameter
- File deletion events in system logs from web server process
Network Indicators:
- POST requests to backup endpoints with suspicious parameters
SIEM Query:
source="web_access.log" AND (uri_path="/admin/backup" AND (param="deleteBackup" OR method="POST"))