Ghost vulnerable to remote code execution in locale setting change

published 2022-06-17 4y ago modified 2022-08-10 4y ago

cvss: 6.6; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

### Impact

A [vulnerability](https://www.cve.org/CVERecord?id=CVE-2022-24785) in an upstream library means an authenticated attacker can abuse locale input to execute arbitrary commands from a file that has previously been uploaded using the file upload functionality in the post editor.

### Patches

Fixed in 5.2.3, all 5.x sites should update as soon as possible. Fixed in 4.48.2, all 4.x sites should update as soon as possible.

### Workarounds

Patched versions of Ghost add validation to the locale input to prevent execution of arbitrary files. Updating Ghost is the quickest complete solution.

As a workaround, if for any reason you cannot update your Ghost instance, you can block the `POST /ghost/api/admin/settings/` endpoint, which will also disable updating settings for your site.

### For more information

If you have any questions or comments about this advisory: * Email us at [security@ghost.org](mailto:security@ghost.org)

### Credits

* devx00 - https://twitter.com/devx00

Patch / fix

fixed in 1

npm ghost 4.48.2, 5.2.3

Is GHSA-7v28-g2pq-ggg8 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	6.6	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

Affected packages

ecosystem	package	affected	fixed in
npm	ghost	<4.48.2 >=5.0.0, <5.2.3	4.48.2 5.2.3

References

Sources

GitHub Advisory GHSA-7v28-g2pq-ggg8

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.