GHSA-r97q-ghch-82j9 BIT-ghost-2023-31133 CVE-2023-31133
Ghost vulnerable to information disclosure of private API fields
- Severity
- 7.5 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 45.71%
- Chance of exploitation in the next 30 days. Higher than 98.80% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
- Fix
5.46.1- Upgrade ghost to this version or later
Description
Impact
Due to a lack of validation when filtering on the public API endpoints, it is possible to reveal private fields via a brute force attack.
Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added.
Self-hosters are impacted if running Ghost a version below v5.46.1. Immediate action should be taken to secure your site - see patches and workarounds below.
Patches
v5.46.1 contains a fix for this issue.
Workarounds
Add a block for requests to /ghost/api/content/* where the filter query parameter contains password or email.
For more information
If you have any questions or comments about this advisory:
- Email us at security@ghost.org
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| ghost | < 5.46.1 |
5.46.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
ghost npm → 5.46.1
- npm
npm install ghost@5.46.1- yarn
yarn add ghost@5.46.1- pnpm
pnpm add ghost@5.46.1
Severity breakdown
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Weakness
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
How to prevent it
- Architecture and Design: Compartmentalize the system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. Ensure that appropriate compartmentalization is built into the system design, and the compartmentalization allows for and reinforces privilege separation functionality. Architects and designers should rely on the principle of least privilege to decide the appropriate time to use privileges and the time to drop privileges.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-x3mg-q38v-m562 Ghost: Authorization Issue Allowed Author Role to Delete any Post | Medium | Also affects ghost |
| GHSA-8575-cr6v-7jh4 Ghost: Stored XSS via SVG Uploads Bypassing Sanitization | High | Also affects ghost |
| GHSA-r7f2-6fj8-6fg2 Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses | Medium | Also affects ghost |
| GHSA-322m-ff4g-9vx9 Ghost: Server-Side Request Forgery in Bookmark Fetching | Medium | Also affects ghost |
| GHSA-fwh9-qg68-vxp4 Ghost: Regular Expression Denial of Service in Content Import | Medium | Also affects ghost |
| GHSA-9m4w-fmjw-fvjq Ghost: Regular Expression Denial of Service in External Media Inliner | Medium | Also affects ghost |
| GHSA-hqq2-xqr2-fmx2 Ghost : Stored XSS via SVG Files in Content Imports | Medium | Also affects ghost |
| GHSA-69qc-f5m6-889c Ghost: Stored XSS via Embed Card Previews | High | Also affects ghost |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor