PT-2022-18244 · Ghost · Ghost

Published 2022-04-12 · Updated 2024-08-03 · CVE-2022-27139

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ghost version 4.39.0

Description The issue concerns an arbitrary file upload vulnerability in the file upload module, potentially allowing attackers to execute arbitrary code via a crafted SVG file. However, the vendor states that uploading SVG files does not represent a remote code execution vulnerability, as SVGs are not executable on the server and may only execute JavaScript in a client's browser, which is expected and intentional functionality. The upload of SVGs is only possible by trusted authenticated users.

Recommendations For Ghost version 4.39.0, consider restricting the upload of SVG files to trusted users or disabling the file upload module temporarily until further guidance is provided. However, according to the vendor, the current functionality is intentional and does not pose a remote code execution risk. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BIT-GHOST-2022-27139

CVE-2022-27139

GHSA-FVC6-QJP7-M4G4

Affected Products

Ghost

References · 9

• 🔥 https://youtu.be/FCqWEvir2wE · Exploit
• https://osv.dev/vulnerability/CVE-2022-27139 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fvc6-qjp7-m4g4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-27139 · Security Note
• https://osv.dev/vulnerability/BIT-ghost-2022-27139 · Vendor Advisory
• https://github.com/TryGhost/Ghost · Note
• https://t.me/cibsecurity/40648 · Telegram Post
• http://ghost.org/docs/security/#privilege-escalation-attacks · Note
• https://t.me/cvenotify/88703 · Telegram Post