Stored XSS in Bludit SVG Image Uploads

Bludit is vulnerable to Stored Cross-Site Scripting (XSS) in its image upload functionality. An authenticated attacker with content upload privileges (such as Author, Editor, or Administrator) can upload an SVG file containing a malicious payload, which is executed when a victim visits the URL of the uploaded resource. The uploaded resource itself is accessible without authentication. The vendor was notified early about this vulnerability, but stopped responding in the middle of coordination. All versions up to 3.18.2 are considered to be vulnerable, future versions might also be vulnerable.

• The bludit package for Bludit: all versions through 3.18.2 are identified by the CNA as affected.
• Future versions might also be affected.
• No exact fixed release is confirmed. The reviewed 3.18.2 release page lists general changes such as UI Search fixes and theme improvements, but does not establish that this Stored XSS issue was fixed.

The Bludit product processes SVG files through its image upload functionality but permits an uploaded file containing a malicious payload to be stored and served at a URL that is accessible without authentication. The confirmed attack flow is:

1. An attacker authenticates with an account that has content upload privileges, such as Author, Editor, or Administrator.
2. The attacker uploads an SVG file containing a malicious payload.
3. When a victim visits the URL of the uploaded resource, the payload executes in the victim's browser.

The weakness is classified as CWE-79, Improper Neutralization of Input During Web Page Generation. The specific implementation details, including the SVG validation or sanitization behavior, endpoint, storage path, and payload, are not established by the available evidence.

The vulnerability is reachable over the network. The attacker must have an authenticated account with content upload privileges, but the uploaded SVG resource can be accessed without authentication. The attack requires low complexity and active user interaction, because a victim must visit the resource URL for the payload to execute. The supplied record does not establish a known exploitation status, and it does not identify a public exploit.

The confirmed technical outcome is execution of attacker-controlled script in a victim's browser after the victim accesses the SVG resource. Because the resource is accessible without authentication, the victim does not necessarily need to be logged in, although the victim must actively visit the URL. The practical impact may include reading or changing data available to the browser or performing actions as the victim, depending on the deployment context. The available evidence describes client-side execution only and does not establish server-side code execution, server compromise, or service disruption.

An uploaded malicious SVG can be made publicly reachable after upload, expanding the potential victim pool beyond authenticated users. When a victim accesses the resource, attacker-controlled script may perform actions within the browser context available to that victim, depending on the victim's permissions and the deployment context. This could affect data or administrative actions available to the victim, but the available evidence does not confirm a specific data theft, account takeover, or breach.

1. Treat every Bludit installation through 3.18.2 as potentially exposed and prioritize version inventory across the environment.
2. No exact fixed release is confirmed for this vulnerability. Do not treat 3.18.2 as a fix solely because it is a release version.
3. Until a confirmed fix is available, restrict content upload privileges to trusted users and consider temporarily disabling SVG uploads if the deployment supports it. This is a precautionary measure, not confirmed vendor remediation.
4. Review previously uploaded SVG resources and remove or isolate untrusted content according to the organization's incident-handling process, preserving relevant evidence before deletion.

1. Inventory all servers running Bludit and identify the installed version, with particular attention to versions through 3.18.2.
2. Review accounts with content upload privileges, including Author, Editor, and Administrator roles and equivalent custom permissions.
3. Search for SVG resources uploaded through the image upload functionality and verify whether their URLs are reachable without authentication. Perform this check only in an authorized environment and without using a malicious payload.
4. Review access logs for uploaded-resource URLs and correlate them with file-upload activity to identify unusual SVG resources or access shortly after upload.

The available evidence provides no specific IOC, path, endpoint, or log signature for this vulnerability. The absence of matching log activity does not prove that a system is safe.