CVE-2024-24550 Bludit - Remote Code Execution (RCE) through File API
Attackers with API tokens can upload malicious PHP files via the File API, leading to remote code execution on the Bludit server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-24550?
CVE-2024-24550 is a high-severity vulnerability in Bludit, published on 24 Jun 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security vulnerability has been identified in Bludit, allowing attackers with knowledge of the API token to upload arbitrary files through the File API which leads to arbitrary code execution on the server. This vulnerability arises from improper handling of file uploads, enabling malicious actors to upload and execute PHP files.
Which versions are affected by CVE-2024-24550?
It affects 1 product.
Products include Bludit Bludit.
How do I fix CVE-2024-24550?
No fix has been published for CVE-2024-24550 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-24550 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-24550 exists.
Other vulnerabilities in Bludit
Sources
Also known as GHSA-37f5-2pjr-46xw.