Ghost CMS Denial of Service via Excessive CPU in External Media Inliner

Executive Summary

This vulnerability is a Regular Expression Denial of Service (ReDoS) in the Ghost CMS. It occurs when a crafted request to the external media inliner causes excessive CPU usage, making the server unresponsive. The issue affects Ghost versions 5.37.0 through 6.65.0 and requires Administrator access to exploit.

Useful 0 Not Useful 0

Detection Guidance

Detecting this vulnerability requires checking Ghost server logs for excessive CPU usage during media inlining operations. Monitor for patterns where regex processing causes timeouts or server unresponsiveness. No specific commands are provided in the context, but you can use system monitoring tools like top, htop, or ps to observe CPU load spikes during Ghost operations.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can make the Ghost server unresponsive due to high CPU usage, disrupting service availability. It requires Administrator access to exploit, so unauthorized users cannot trigger it. Self-hosted users running affected versions should update to version 6.67.0 or later to mitigate the risk.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability primarily impacts system availability due to excessive CPU usage, which could lead to service disruptions. While it does not directly expose or leak data, prolonged unavailability could interfere with logging, monitoring, or backup processes required by GDPR or HIPAA. However, the provided context does not specify direct compliance impacts beyond potential availability issues.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update Ghost to version 6.67.0 or later to patch the vulnerability. If updating is not possible, restrict Administrator access to the Ghost server to prevent exploitation. Monitor server performance and disable the external media inliner if excessive CPU usage is detected.

Useful 0 Not Useful 0