CVE-2024-24550
📋 TL;DR
This vulnerability in Bludit allows attackers with API token access to upload arbitrary files, including PHP files, leading to remote code execution on the server. It affects Bludit installations with exposed File API endpoints. Attackers can gain full control of affected systems.
💻 Affected Systems
- Bludit
📦 What is this software?
Bludit by Bludit
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or use as attack infrastructure
Likely Case
Webshell installation allowing persistent access, data exfiltration, and lateral movement
If Mitigated
Limited impact if API tokens are properly secured and file uploads are restricted
🎯 Exploit Status
Exploitation requires API token but is straightforward once obtained
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.0.0
Vendor Advisory: https://www.redguard.ch/blog/2024/06/20/security-advisory-bludit/
Restart Required: No
Instructions:
1. Backup your Bludit installation. 2. Download Bludit 4.0.0 or later. 3. Replace existing files with new version. 4. Verify functionality.
🔧 Temporary Workarounds
Restrict File API Access
allBlock access to File API endpoints via web server configuration
# Apache: Add to .htaccess
<FilesMatch "api/file">
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~ /api/file {
deny all;
}
Disable PHP Execution in Uploads
allPrevent PHP execution in upload directories
# Apache: Add to .htaccess
<FilesMatch "\.php$">
Deny from all
</FilesMatch>
# Nginx: Add to server block
location ~ \.php$ {
deny all;
}
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Bludit instances
- Deploy WAF rules to block suspicious file upload patterns
🔍 How to Verify
Check if Vulnerable:
Check Bludit version in admin panel or via version.txt fileCheck Version:
cat /path/to/bludit/bl-content/databases/site.php | grep versionVerify Fix Applied:
Confirm version is 4.0.0 or higher in admin panel📡 Detection & Monitoring
Log Indicators:
- Unusual file uploads via API endpoints
- PHP file creation in upload directories
- Multiple failed API authentication attempts
Network Indicators:
- POST requests to /api/file endpoints
- Uploads of files with .php extensions
SIEM Query:
source="web_logs" AND (uri="/api/file" OR file_extension="php")