GHSA-gcvv-72q8-9v76: SSRF
Impact
A Server-Side Request Forgery (SSRF) in Ghost Admin allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts.
Vulnerable versions
This vulnerability is present in Ghost from v0.10.0 up to v6.54.0.
Patches
v6.54.1 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks Younghun Ko, vx77, and Miguel Segovia Gil for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.54.1 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in v6.54.1 - Compensating control
For Docker-based Ghost self-hosters, update the Ghost Docker image by following the documented procedure for updating a Docker-based Ghost instance (docs.ghost.org/install/docker#updating-ghost).
Event History
Frequently Asked Questions
What is the severity of GHSA-gcvv-72q8-9v76?
The severity of GHSA-gcvv-72q8-9v76 is medium, rated at 4.1.
How do I fix GHSA-gcvv-72q8-9v76?
To fix GHSA-gcvv-72q8-9v76, you should update to the latest version of Ghost that has patched this vulnerability.
What type of vulnerability is GHSA-gcvv-72q8-9v76?
GHSA-gcvv-72q8-9v76 is a Server-Side Request Forgery (SSRF) vulnerability.
Who is affected by GHSA-gcvv-72q8-9v76?
Any staff-level user with access to Ghost Admin is affected by GHSA-gcvv-72q8-9v76.
What impact does GHSA-gcvv-72q8-9v76 have?
GHSA-gcvv-72q8-9v76 allows a user to perform blind HTTP GET requests against internal hosts, potentially probing open ports.