Ghost CMS Admin API Information Disclosure via Password Hash Exposure

Executive Summary

Ghost 5.42.2 before 6.58.0 has an information disclosure vulnerability in the Admin API bulk post and page edit and delete endpoints. Staff-level attackers can exploit this to infer other staff users' password hashes by using filters on restricted fields like authors.password. This occurs because the endpoints improperly filter these fields, allowing offline password-guessing attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check Ghost CMS versions between 5.42.2 and 6.58.0. Use commands like 'ghost version' to verify the installed version. Monitor Admin API logs for bulk post/page edit/delete requests with filters containing restricted fields such as authors.password.

Useful 0 Not Useful 0

Impact Analysis

If you are a Ghost CMS user running versions 5.42.2 to 6.57.0, a staff-level attacker could potentially access your password hash. This could lead to unauthorized account access if the hash is cracked through offline attacks. The impact is limited to staff users and requires staff-level privileges to exploit.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by exposing sensitive user data (password hashes). GDPR requires protection of personal data, while HIPAA mandates safeguarding protected health information. A breach could lead to regulatory penalties or loss of trust.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately upgrade Ghost CMS to version 6.58.0 or later. Apply the patch from the official Ghost repository commit 5ef16abe85e9b71ac3f1b1e2cbc462802efe3b5b to enforce validation of filter fields in bulk operations.

Useful 0 Not Useful 0