Attack Chain

1. Attacker authenticates as an administrative user or gains access to the image upload endpoint.
2. Attacker crafts a malicious SVG file containing an <?xml-stylesheet?> XML processing instruction.
3. Attacker embeds an XSLT transformation within the SVG that includes a <script> block containing the desired JavaScript payload.
4. Attacker sends a POST request to /admin/ajax/upload-images with the malicious SVG file as a multipart/form-data payload.
5. The application fails to strip the XML processing instructions in sanitizeSVG() and stores the file in /bl-content/uploads/.
6. The attacker or a victim navigates to the URL of the uploaded SVG file.
7. The browser renders the SVG, triggers the XSLT stylesheet, and executes the embedded JavaScript payload.

Impact

Successful exploitation allows for arbitrary code execution in the victim's browser session. If an administrator is tricked into viewing the malicious file, the attacker can perform unauthorized administrative actions, modify site content, or steal session cookies, potentially leading to full site compromise.

Recommendation

Prioritized actions for security teams:

• Verify your Bludit CMS version and upgrade to a patched release if available.
• Implement strict server-side content-type validation and disable the execution of XML processing instructions for user-uploaded SVG files.
• Use Content Security Policy (CSP) headers to restrict script execution for content hosted on the site's media storage domain.
• Deploy the suggested web server detection rule to monitor for suspicious file uploads containing XML stylesheet references.