Ghost CMS Information Disclosure via Unauthenticated Setup Endpoint

Executive Summary

This vulnerability is an information disclosure issue in Ghost versions 0.8.0 to 6.23.0. The setup endpoint responds to unauthenticated requests by revealing the site owner's email address, allowing any remote visitor to obtain it without needing privileges or interaction.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Ghost instance is running a version between 0.8.0 and 6.22.x. You can verify the version by running: curl -s http://your-ghost-domain.com/ghost/api/v3/admin/ | grep version. If the version is below 6.23.0, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this to obtain the site owner's email address, potentially leading to phishing attacks, spam, or further social engineering attempts against the owner or associated users.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability may violate data protection regulations like GDPR by exposing personal data (email address) without consent. It could also impact HIPAA compliance if the email is linked to protected health information, though Ghost is not typically used in HIPAA-covered contexts.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Ghost to version 6.23.0 or later. If updating is not possible, restrict access to the setup endpoint by configuring your web server to block unauthenticated requests to paths containing /setup/. For example, in Nginx, add location ~ /setup { deny all; } to your server block.

Useful 0 Not Useful 0