GHSA-xm43-3m56-w3wf: Medium severity npm/ghost vulnerability
Impact
A vulnerability in Ghost's public donation checkout flow allowed an unauthenticated attacker to obtain full paid gift memberships for a minimal payment. No customer or member data was exposed, and the issue could not be used to steal money from a site or its members.
Vulnerable versions
This vulnerability is present in Ghost from v6.27.0 up to v6.43.1.
Patches
v6.44.0 contains a fix for this issue.
How to update
For self-hosters using Docker, find Docker’s official Ghost image on Docker Hub and follow the documentation on updating a Docker-based Ghost instance.
For self-hosters using Ghost-CLI, see the documentation for updating Ghost to the latest version.
Workarounds
If upgrading immediately is not possible, you can remove the vulnerable checkout path by disabling the donations feature in Ghost Admin under Settings → Membership → Tips & donations until the upgrade is applied.
References
Ghost thanks sane100400 and p4p3r for disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email Ghost at security@ghost.org.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/ghostto a version that resolves this vulnerability.Fixed in 6.44.0 - Upgrade
Upgrade
Ghostto a version that resolves this vulnerability.Fixed in v6.44.0 - Configuration
If upgrading immediately is not possible, disable the donations feature in Ghost Admin (Settings → Membership → Tips & donations) to remove the vulnerable checkout path until the upgrade is applied.
Ghost Admin Settings → Membership → Tips & donations (donations feature) = disabled
Event History
Frequently Asked Questions
What is the severity of GHSA-xm43-3m56-w3wf?
The severity of GHSA-xm43-3m56-w3wf is classified as medium with a score of 5.3.
How can I fix GHSA-xm43-3m56-w3wf?
To fix GHSA-xm43-3m56-w3wf, upgrade to the patched version of Ghost that addresses this vulnerability.
What impact does GHSA-xm43-3m56-w3wf have on my site?
GHSA-xm43-3m56-w3wf allows an unauthenticated attacker to obtain full paid gift memberships for a minimal payment, but does not expose customer data.
Is customer data exposed due to GHSA-xm43-3m56-w3wf?
No, GHSA-xm43-3m56-w3wf does not expose any customer or member data.
Could GHSA-xm43-3m56-w3wf result in financial theft?
No, GHSA-xm43-3m56-w3wf cannot be used to steal money from a site or its members.