Ghost Admin Session Hijack via Feature Image Caption

Executive Summary

This vulnerability in Ghost CMS allows a staff user with limited privileges to craft a post with malicious content in the feature_image_caption field. When another staff user views this post in Ghost Admin, the malicious content can hijack their session, leading to unauthorized privilege escalation.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Ghost CMS version is between 4.9.0 and 6.54.0. Update to 6.54.1 or later to patch the issue. Inspect posts for malicious feature image captions containing scripts or unsafe URLs. Use commands like 'ghost version' to check the version and review admin session logs for unusual activity.

Useful 0 Not Useful 0

Impact Analysis

If you are a Ghost CMS user running versions between 4.9.0 and 6.54.0, an attacker with staff access could exploit this to gain higher privileges, potentially accessing sensitive data or performing unauthorized actions in your admin panel.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to user data, violating GDPR's data protection principles or HIPAA's security requirements for protected health information. Organizations using affected Ghost versions may face compliance risks if exploited.

Useful 0 Not Useful 0

Mitigation Strategies

Update Ghost to version 6.54.1 or later to address the input validation issue in feature_image_caption that allows session hijacking and privilege escalation.

Useful 0 Not Useful 0