Vulnerability · Published Apr 29, 2021 · Assigned by GitHub_M
CVE-2021-29484DOM XSS in Theme Preview
Medium 6.8
In plain English
A medium-severity cross-site scripting in Ghost from TryGhost. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 7.9% (higher than 95% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site. The issue has been fixed in 4.3.3, all 4.x sites should upgrade as soon as possible. As the endpoint is unused, the patch simply removes it. As a workaround blocking access to /ghost/preview can also mitigate the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | ghost | 4.3.3 | GHSA-9fgx-q25h-jxrg |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
References
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg x_refsource_CONFIRM
- https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290 x_refsource_MISC
- https://www.npmjs.com/package/ghost x_refsource_MISC
- https://blog.sonarsource.com/ghost-admin-takeover x_refsource_CONFIRM