PT-2021-18246 · Ghost · Ghost

Paul Gerste

·

Published

2021-04-29

·

Updated

2024-03-06

·

CVE-2021-29484

CVSS v3.1

6.8

Medium

VectorAV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
Name of the Vulnerable Software and Affected Versions: Ghost versions 4.0.0 through 4.3.2
Description: An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched, and there is no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.
Recommendations: For Ghost versions 4.0.0 through 4.3.2, upgrade to version 4.3.3 as soon as possible. As a temporary workaround, consider blocking access to the /ghost/preview endpoint to mitigate the issue. To block access in nginx, use the following configuration:
location ~ /ghost/preview {
  rewrite ^(/(.*/)?ghost/)(.*)$ $1 redirect;
}
This redirects the endpoint to /ghost/, which mimics the behaviour after the patch is applied. Additionally, logging out of Ghost Admin, suspending any users who cannot log out, can also help mitigate the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BIT-GHOST-2021-29484
CVE-2021-29484
GHSA-9FGX-Q25H-JXRG

Affected Products

Ghost