Impact An attacker was able to craft a malicious link that, when accessed by an authenticated staff user or member, would execute JavaScript with the victim's permissions, potentially leading to account takeover.
Vulnerable versions This vulnerability is present in Ghost versions: - v5.43.0 to v5.120.4 - v6.0.0 to v6.14.0
As well as in Portal versions: - v2.29.1 to v2.51.4 - v2.52.0 to v2.57.0
Patches Ghost automatically loads the latest patch of the members Portal component via CDN. Therefore: - For Ghost 5.x users, upgrading to v5.121.0 or later fixes the vulnerability (loads Portal v2.51.5, which contains the patch) - For Ghost 6.x users, upgrading to v6.15.0 or later fixes the vulnerability (loads Portal v2.57.1, which contains the patch)
For Ghost installations using a customised or self-hosted version of Portal, it will be necessary to manually rebuild from or update to the latest patch version.
References Ghost thanks Younes Belalia for discovering and disclosing this vulnerability responsibly.
For more information If users have any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost's /ghost/api/admin/members/events endpoint allows users with authentication credentials for the Admin API to execute arbitrary SQL.
Vulnerable versions This vulnerability is present in Ghost v5.90.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost’s media inliner mechanism allows staff users in possession of a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems via SSRF.
Vulnerable versions This vulnerability is present in Ghost v5.38.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost's handling of Staff Token authentication allowed certain endpoints to be accessed that were only intended to be accessible via Staff Session authentication. External systems that have been authenticated via Staff Tokens for Admin/Owner-role users would have had access to these endpoints.
Vulnerable versions This vulnerability is present in Ghost v5.121.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact A vulnerability in Ghost's 2FA mechanism allows staff users to skip email 2FA.
Vulnerable versions This vulnerability is present in Ghost v5.105.0 to v5.130.5 to and Ghost v6.0.0 to v6.10.3.
Patches v5.130.6 and v6.11.0 contain a fix for this issue.
References Ghost thanks Sho Odagiri of GMO Cybersecurity by Ierae, Inc. for discovering and disclosing this vulnerability responsibly.
For more information If there are any questions or comments about this advisory, email Ghost at security@ghost.org.
Impact
A vulnerability in Ghost's oEmbed mechanism allows staff users to exfiltrate data from internal systems via SSRF.
Vulnerable versions
This vulnerability is present in Ghost v5.99.0 to v5.130.3 to and Ghost v6.0.0 to v6.0.8.
Patches
v5.130.4 and v6.0.9 contain a fix for this issue.
References
The original report is available here: https://fluidattacks.com/advisories/regida
We thank Cristian Vargas for discovering and disclosing this vulnerability responsibly.
For more information
If you have any questions or comments about this advisory, email us at security@ghost.org.