Bypass of Email 2FA in Ghost CMS Allows Unauthorized Access

Executive Summary

This vulnerability in the Ghost content management system's two-factor authentication (2FA) mechanism allowed staff users to bypass the email-based 2FA process. The issue was caused by a property called `skipEmailVerification` in the session creation API, which was originally intended to allow bypassing 2FA immediately after a password reset (assuming the password reset via email verified the user). However, this property could be exploited by any user to skip 2FA without proper verification. The vulnerability was fixed by removing this insecure bypass and introducing a secure one-time password (OTP) verification system that requires a valid OTP token sent via email after a password reset to bypass 2FA legitimately. [1, 3]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows staff users to bypass email-based two-factor authentication (2FA), which can lead to unauthorized access to sensitive data. This unauthorized access could compromise data confidentiality and integrity, potentially violating compliance requirements under standards like GDPR and HIPAA that mandate strong authentication controls to protect personal and sensitive information. Therefore, the vulnerability negatively impacts compliance by weakening authentication security and increasing the risk of data breaches. [2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker with low privileges to remotely bypass the two-factor authentication process for staff users without any user interaction. This can lead to unauthorized access to staff accounts, potentially compromising the confidentiality and integrity of sensitive data managed by the Ghost platform. Since 2FA is bypassed, attackers can perform actions as legitimate staff users, increasing the risk of data breaches and unauthorized modifications. [2]

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by checking if your Ghost installation is running a vulnerable version (5.105.0 through 5.130.5 or 6.0.0 through 6.10.3). Additionally, monitoring API requests to the session creation endpoint for the presence of the `skipEmailVerification` property in requests could indicate exploitation attempts. Since the vulnerability involves bypassing 2FA via API manipulation, inspecting logs for unusual session creation requests containing `skipEmailVerification` or unexpected session creations without proper 2FA tokens can help detect exploitation. Specific commands depend on your environment, but for example, you can grep your server logs for `skipEmailVerification` usage: `grep -r skipEmailVerification /path/to/ghost/logs` or monitor network traffic for such API calls. Also, verifying the Ghost version can be done by running `ghost version` in the installation directory. [1, 3]

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Ghost to a patched version: 5.130.6 or later in the 5.x series, or 6.11.0 or later in the 6.x series. These versions remove the insecure `skipEmailVerification` property and implement a secure OTP-based verification process for 2FA bypass after password reset. Until you can upgrade, monitor and restrict API access to prevent unauthorized use of the `skipEmailVerification` property, and consider disabling staff user 2FA bypass features if possible. Applying the official patch or upgrade is the recommended and effective mitigation. [2, 1, 3]

Useful 0 Not Useful 0