GHSA-944x-pm95-3jpr: Malicious File Upload
Impact
Insufficient validation of the client-supplied Content-Type on Ghost's Admin API file upload endpoint allowed uploaded files to be served from the site with an attacker-chosen content type on S3/GCS storage backends. On installations that serve uploaded files from the same origin as the site, this could have been used to facilitate stored cross-site scripting against site visitors or staff.
Vulnerable versions
This vulnerability is present in Ghost from v6.19.4 up to v6.21.0.
Patches
v6.21.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.21.1 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in v6.21.1
Event History
Frequently Asked Questions
What is the severity of GHSA-944x-pm95-3jpr?
The severity of GHSA-944x-pm95-3jpr is classified as medium with a score of 5.4.
How do I fix GHSA-944x-pm95-3jpr?
To fix GHSA-944x-pm95-3jpr, ensure that file uploads to the Admin API are validated for correct `Content-Type` before processing.
What is the impact of GHSA-944x-pm95-3jpr?
The impact of GHSA-944x-pm95-3jpr is that it allows uploaded files to be served with an attacker-chosen content type, which can be exploited.
Which software is affected by GHSA-944x-pm95-3jpr?
The software affected by GHSA-944x-pm95-3jpr is npm/ghost.
What type of vulnerability is GHSA-944x-pm95-3jpr?
GHSA-944x-pm95-3jpr is classified as a Malicious File Upload vulnerability.