Stored XSS Vulnerability in Bludit CMS

Bludit CMS version 3.22.0 is susceptible to a stored Cross-Site Scripting (XSS) vulnerability due to incomplete sanitization of SVG files. The application's sanitizeSVG() function fails to remove XML processing instructions, specifically the <?xml-stylesheet?> directive. An attacker can craft a malicious SVG file containing an XSLT transformation that points to a local or remote stylesheet. When this file is uploaded through the administrative interface and subsequently viewed by a user, the XSLT processor executes the embedded JavaScript. This allows an attacker to achieve unauthorized script execution in the context of the user's browser, which can lead to session hijacking, administrative credential theft, or further actions performed on behalf of the victim.

Attack Chain

1. Attacker authenticates as an administrative user or gains access to the image upload endpoint.
2. Attacker crafts a malicious SVG file containing an <?xml-stylesheet?> XML processing instruction.
3. Attacker embeds an XSLT transformation within the SVG that includes a <script> block containing the desired JavaScript payload.
4. Attacker sends a POST request to /admin/ajax/upload-images with the malicious SVG file as a multipart/form-data payload.
5. The application fails to strip the XML processing instructions in sanitizeSVG() and stores the file in /bl-content/uploads/.
6. The attacker or a victim navigates to the URL of the uploaded SVG file.
7. The browser renders the SVG, triggers the XSLT stylesheet, and executes the embedded JavaScript payload.

Impact

Successful exploitation allows for arbitrary code execution in the victim's browser session. If an administrator is tricked into viewing the malicious file, the attacker can perform unauthorized administrative actions, modify site content, or steal session cookies, potentially leading to full site compromise.

Recommendation

Prioritized actions for security teams:

• Verify your Bludit CMS version and upgrade to a patched release if available.
• Implement strict server-side content-type validation and disable the execution of XML processing instructions for user-uploaded SVG files.
• Use Content Security Policy (CSP) headers to restrict script execution for content hosted on the site's media storage domain.
• Deploy the suggested web server detection rule to monitor for suspicious file uploads containing XML stylesheet references.