Executive brief
Ghost is a popular open-source platform for building modern publishing websites with membership and subscription features. An authenticated attacker can exploit improper validation of locale input settings to execute arbitrary commands from previously uploaded files, potentially compromising the entire website and its data. This requires the attacker to have administrative access and previously uploaded a malicious file, but the impact could include data theft, website defacement, or complete server takeover.
Technical details
The vulnerability exists in Ghost's handling of locale input within the settings API endpoint (POST /ghost/api/admin/settings/), where an upstream library fails to properly validate user-supplied locale values. An authenticated attacker with administrative privileges can abuse this input to execute arbitrary commands from files that have been previously uploaded via the post editor's file upload functionality. The attack vector is network-based and requires high privilege level (authenticated admin) but no user interaction. The fix involves adding strict validation to locale input to prevent execution of arbitrary files. Patches are available in versions 4.48.2 and 5.2.3 and later.
Affected products
- Ghost Ghost <=4.48.1, 5.0.0-5.2.2
Timeline
- 2022-06-15: disclosed
- 2022-06-15: patched: Fixed in Ghost 4.48.2 and 5.2.3