Executive brief
Ghost is a popular open-source blogging and content management platform. A vulnerability in its public API endpoints allows attackers to bypass validation controls and retrieve sensitive private fields (such as passwords and email addresses) through brute force attacks, potentially exposing customer data without authentication or special privileges.
Technical details
The vulnerability is an information disclosure flaw (CWE-200) in Ghost's public API endpoints (/ghost/api/content/*) caused by insufficient input validation on filter query parameters. An unauthenticated, network-based attacker can brute force the filter parameter to reveal private fields like passwords and email addresses that should not be exposed via the public API. The attack requires no user interaction or special privileges. The issue affects all versions below 5.46.1; a patch is available in v5.46.1, and a workaround exists by blocking requests containing password or email in filter parameters.
Affected products
- Ghost Ghost < 5.46.1
Timeline
- 2023-05-03: disclosed
- 2023-05-03: patched: v5.46.1