Executive brief
Ghost is a popular open-source blogging platform. When configured to use sendmail for email delivery, it is vulnerable to remote command injection via malicious email parameters. An attacker can inject arbitrary shell commands that execute on the server during email transmission, potentially leading to full system compromise.
Technical details
This vulnerability is a command injection (CWE-88) in Ghost's sendmail email transport, caused by a flaw in the underlying nodemailer dependency. When the sendmail transport is explicitly configured, user-controlled input passed to sendmail flags is not properly sanitized, allowing an attacker to inject shell metacharacters and execute arbitrary commands. The vulnerability requires that sendmail transport be explicitly enabled (Ghost defaults to direct transport, so most deployments are unaffected), and can be exploited remotely without authentication or user interaction. Ghost fixed this issue in version 4.15.0 by updating to a patched version of nodemailer.
Affected products
- Ghost Ghost <4.15.0
Timeline
- 2021-09-20: disclosed: Advisory published
- 2021-09-17: patched: Fix commit dated September 17, 2021; version 4.15.0 released