Executive brief
Ghost, a popular open-source blogging and content management platform, contains a CSV injection vulnerability in its member export feature. An attacker with admin access can craft malicious formulas in member data that execute when the CSV file is opened in spreadsheet applications like Excel, potentially leading to data theft or further compromise of the organization's systems.
Technical details
This is a CSV Injection vulnerability (CWE-74) in Ghost versions prior to 5.82.0, affecting the member CSV export functionality. The vulnerability occurs because user-controlled data fields in member records are not properly escaped when exported to CSV format, allowing attackers to embed formula payloads (e.g., =cmd|'/c...' or =1+1) that are executed by spreadsheet software. The attack requires authentication (admin or user with member export privileges) but no user interaction beyond opening the exported CSV file. An attacker can achieve arbitrary code execution on systems that open the CSV with a formula-evaluating application. The fix, released in version 5.82.0, adds field escaping using papaparse's built-in escape functionality to neutralize formula prefixes in CSV exports.
Affected products
- Ghost Ghost before 5.82.0
Timeline
- 2024-05-22: disclosed
- 2024-05-22: patched: Fixed in version 5.82.0