Executive brief
Ghost is a popular open-source blogging and publishing platform. A server-side request forgery vulnerability allows an authenticated attacker to make the Ghost server send requests to internal systems or external networks on behalf of the attacker, potentially leading to network reconnaissance, credential theft, or access to sensitive internal services.
Technical details
This is a server-side request forgery (SSRF) vulnerability (CWE-918) in Ghost CMS versions prior to 3.10.0. An authenticated attacker can exploit this flaw to cause the Ghost server to send arbitrary HTTP requests to internal or external systems, enabling network reconnaissance and potential interaction with restricted services. The attack requires authentication to the Ghost platform. The vulnerability was fixed in version 3.10.0, and patches are available.
Affected products
- Ghost Ghost CMS < 3.10.0
Timeline
- 2020-03-20: disclosed
- 2021-05-06: advisory
- 2021-05-06: patched: Fixed in version 3.10.0