Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."
An attacker with contributor privileges uploads an SVG file containing embedded JavaScript code as a profile picture. When the SVG file is rendered by the victim's browser, the malicious script executes in the context of the application and communicates with the local Ghost API listening on TCP port 3001. Through API queries, the attacker can perform operations on behalf of the logged-in victim, including compromising their account regardless of permission level.
An attacker can compromise any Ghost CMS user account, including the administrator account, gaining full control over the application instance. The result is complete breach of confidentiality, integrity, and availability of data and the system.
Apply patches available from the vendor according to the references (pull request #19646 in the TryGhost/Ghost repository). It is also recommended to restrict the ability to upload SVG files as avatars by users with low privileges and to monitor API activity on port 3001.
Ghost CMS versions up to and including 5.76.0
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:HGhost
APPGhost≤ 5.76.0
Related vulnerabilities
Ghost CMS: nieuwierzytelniony odczyt bazy danych przez SQL injection
Ghost CMS – obejście limitu prób uwierzytelnienia przez nagłówki X-Forwarded-For
Ghost CMS: Arbitrary File Upload umożliwiający wykonanie kodu (RCE)
Ghost v4.39.0 — przesyłanie plików SVG z potencjalnym wykonaniem kodu po stronie klienta
Ghost is a Node.js content management system. From version 5.101.6 to 6.19.2, incomplete CSRF protections arou...