PT-2024-25905 · Ghost · Ghost

Published 2024-06-16 · Updated 2025-06-23 · CVE-2024-34451

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Ghost versions 5.85.1 and earlier

Description The issue allows remote attackers to bypass an authentication rate-limit protection mechanism by using many X-Forwarded-For headers with different values. The vendor recommends installing Ghost with a reverse proxy that allows only trusted X-Forwarded-For headers.

Recommendations For Ghost versions 5.85.1 and earlier, consider installing a reverse proxy that filters and only allows trusted X-Forwarded-For headers to mitigate the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-1390

Related Identifiers

BIT-GHOST-2024-34451

CVE-2024-34451

Affected Products

Ghost

References · 9

• 🔥 https://docs.google.com/document/d/1iy0X4Vc9xXYoBxFrcW6ATo8GKPV6ivuLVzn6GgEpwqE · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-34451 · Security Note
• https://osv.dev/vulnerability/CVE-2024-34451 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-ghost-2024-34451 · Vendor Advisory
• https://github.com/TryGhost/Ghost/releases · Note
• https://t.me/cvenotify/91380 · Telegram Post
• https://ghost.org/docs/faq/proxying-https-infinite-loops · Note
• https://t.me/cvenotify/88431 · Telegram Post
• https://t.me/cvenotify/83437 · Telegram Post