GHSA-v3xr-g6p2-fvgv: XSS
Impact
Embedding a URL from an attacker-controlled website could result in untrusted scripts being stored in post content. These scripts could run in the Ghost editor, on the published site, and in newsletter emails, possibly resulting in compromise of a staff user's admin session.
Vulnerable versions
This vulnerability is present in Ghost from v2.1.0 up to v6.64.0.
Patches
v6.64.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker's official Ghost image here. Updating a Docker-based Ghost instance is documented here.
If your Ghost is a Ghost-CLI install see our documentation on updating it to the latest version here.
References
Ghost thanks SecBuddyF of Tencent KeenLab and Nhat Anh Vu for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.64.0 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in 6.64.0
Event History
Frequently Asked Questions
What action is required for exploitation?
An attacker needs a URL from an attacker-controlled website to be embedded. Exploitation requires user interaction, consistent with the advisory’s UI:R vector.
Where could injected scripts execute?
The stored scripts could run in the Ghost editor, on the published site, and in newsletter emails. A staff user’s admin session could potentially be compromised.
What should self-hosted administrators do?
Update Ghost to v6.64.0, which the advisory identifies as containing the fix. Docker-based installations should update their Ghost image, while Ghost-CLI installations should use the documented Ghost update process.
What can be done before an update is available?
Do not embed URLs from attacker-controlled or untrusted websites. Because the payload can be stored in post content, treat such embeds as potentially unsafe until the instance is updated.