Executive brief
Ghost is a popular content management system and blogging platform. The vulnerability allows a contributor to upload a malicious SVG file as a profile picture containing embedded JavaScript code. When executed, this code can interact with Ghost's API to perform unauthorized actions, including taking over administrator accounts, even though the vendor disputes this as a valid attack vector.
Technical details
Ghost versions up to 5.76.0 are vulnerable to stored XSS (CWE-79) via insufficient sanitization of SVG file uploads in staff profile pictures. The vulnerability permits a contributor (authenticated user) to upload an SVG file containing embedded JavaScript that executes in the context of other users viewing the profile, specifically targeting the API on localhost port 3001. An attacker with contributor privileges can inject malicious JavaScript into an SVG profile picture; when an admin or other user views this picture, the JavaScript executes in their browser and can interact with the Ghost API to perform actions on their behalf, potentially leading to account takeover. The fix integrates DOMPurify to sanitize SVG content during upload, removing malicious script payloads while preserving legitimate SVG functionality.
Affected products
- Ghost Ghost through 5.76.0
Timeline
- 2024-02-11: disclosed: Published to GitHub Security Advisory
- 2024-02-12: patched: Fix PR #19646 submitted with DOMPurify integration