Ghost is a Node.js content management system. From 6.22.1 until 6.64.0, Ghost restricted the content type used to serve uploaded files to prevent browsers from executing them. On sites using the default local storage adapter, this restriction was not applied, so files uploaded by any staff user were served with a content type derived from their file extension.
This could be used to host scripts on the site's domain, possibly resulting in compromise of other staff users' admin sessions. This issue is fixed in version 6.64.0.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
Required
User action required
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
None
No disruption
CVSS Vector v3.1
Weakness Type (CWE)
Vulnerable Products
tryghost:ghost
References 4
https://github.com/TryGhost/Ghost/security/advisories/GHSA-gfjp-2p8f-94qv
https://github.com/TryGhost/Ghost/security/advisories/GHSA-gfjp-2p8f-94qv
https://github.com/TryGhost/Ghost/pull/30762
https://github.com/TryGhost/Ghost/pull/30762
https://github.com/TryGhost/Ghost/commit/58669d5c8b898f8b69c1287c2779b29ecc7eb9…
https://github.com/TryGhost/Ghost/commit/58669d5c8b898f8b69c1287c2779b29ecc7eb918
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0
https://github.com/TryGhost/Ghost/releases/tag/v6.64.0