Description

An issue in Bludit CMS 3.22.0 allows a remote attacker to obtain sensitive information via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.9",
  "pubDate": "2026-10-06T17:17:28.207Z",
  "pubdate": "2026-10-06T17:17:28.207Z",
  "executiveSummary": "Bludit CMS version 3.22.0 is susceptible to an information disclosure vulnerability residing within the administrative backend.\nThe flaw allows unauthorized remote attackers to retrieve sensitive system data via the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints.\nThis vulnerability stems from improper access control mechanisms, permitting interaction with these AJAX endpoints without sufficient validation of user sessions or permissions.\nBy leveraging this defect, an attacker can extract sensitive information, which may include configuration data, user details, or internal system paths, potentially facilitating further exploitation or reconnaissance.\nThe issue poses a significant risk to the integrity and confidentiality of the CMS installation, as the endpoints are reachable over the network and do not require elevated privileges for interaction.\nSuccessful exploitation allows an unauthenticated or low-privileged attacker to bypass intended access restrictions, leading to the exposure of data intended only for administrative review.",
  "technicalDetails": "The vulnerability is localized within the Bludit CMS administrative panel, specifically impacting the logic handled by the /admin/ajax/clippy and /admin/ajax/save-as-draft endpoints.\nRoot Cause: The underlying issue is an authorization bypass, wherein the application fails to strictly enforce authentication or authorization checks when processing requests directed at these specific AJAX handlers.\nAttack Flow: A remote attacker identifies the target CMS installation and crafts HTTP requests directed toward the vulnerable endpoints. Because the backend logic lacks comprehensive session validation for these routes, the application processes the requests and returns the requested data directly to the requester.\nFor the /admin/ajax/clippy endpoint, the application may inadvertently disclose sensitive clipboard or session-related data stored in the server-side state. Similarly, the /admin/ajax/save-as-draft endpoint, which is designed to handle temporary content storage, is reachable through these insecure conduits, allowing an attacker to capture sensitive draft data or internal metadata that was not intended for public access.\nThe exploitation does not require advanced technical skill or specialized payloads; standard HTTP requests using common tools like cURL or Burp Suite are sufficient to elicit a response containing the restricted information.\nThe vulnerable components are the server-side scripts responsible for handling AJAX requests within the administrative directory path (/admin/ajax/). In Bludit 3.22.0, the framework fails to gatekeep access to these controllers, effectively exposing administrative functionality to the public web interface.\nPost-Exploitation Impact: Beyond the initial loss of confidentiality, the disclosed information could contain credentials, security tokens, or system-level configuration parameters. This facilitates a secondary phase of attack, potentially leading to full administrative takeover if session tokens or authentication bypasses are derived from the leaked metadata.\nNetwork Exposure: The endpoints are accessible over the standard web port, making any Bludit 3.22.0 deployment with an exposed admin interface susceptible to discovery and exploitation by automated scanners or manual probing."
}