CVE-2024-34451

The protection mechanism against excessive login attempts is based on identifying the client's IP address. An attacker can manipulate the X-Forwarded-For header by providing different, crafted IP address values in successive HTTP requests. The system reads these headers as different traffic sources and treats each request as coming from a different client, effectively bypassing the attempt counter and lockout mechanism. As a result, an attacker can attempt to guess passwords without limit and without risk of being blocked.

An attacker can conduct an effective brute-force attack on Ghost CMS user accounts, leading to unauthorized access to the administrative panel and potential takeover of full control over the platform and its content.

Ghost CMS should be updated to a version higher than 5.85.1 according to information in the vendor's references. The vendor additionally indicates that Ghost should be installed behind a reverse proxy configured to accept only trusted X-Forwarded-For headers — this is the recommended architectural mitigation regardless of software version.

Ghost CMS in versions up to and including 5.85.1, installations without a properly configured reverse proxy filtering X-Forwarded-For headers.