Two New Security Flaws Reported in Ghost CMS Blogging Software

Dec 22, 2022Ravie LakshmananWebsite Security / Vulnerability

Cybersecurity researchers have detailed two security flaws in
the JavaScript-based blogging platform known as Ghost^[1], one of which could be
abused to elevate privileges via specially crafted HTTP
requests.

Tracked as CVE-2022-41654 (CVSS score: 8.5), the authentication
bypass vulnerability that allows unprivileged users (i.e., members)
to make unauthorized modifications to newsletter settings.

Cisco Talos, which discovered^[2]
the shortcoming, said it could enable a member to change the
system-wide default newsletter that all users are subscribed to by
default.

“This gives unprivileged users the ability to view and change
settings they were not intended to have access to,” Ghost noted^[3]
in an advisory published on November 28, 2022. “They are not able
to escalate their privileges permanently or get access to further
information.”

The CMS platform blamed the bug due to a “gap” in its API
validation, adding it found no evidence that the issue has been
exploited in the wild.

Also patched by Ghost is an enumeration vulnerability in the
login functionality (CVE-2022-41697, CVSS score: 5.3) that could
lead to the disclosure of sensitive information.

Per Talos, this flaw could be leveraged by an attacker to
enumerate all valid users of Ghost by supplying an email address,
which could then be used to narrow down potential targets for a
next-stage phishing attack.

The flaws have been addressed in the Ghost (Pro) managed hosting
service, but users who self-host the service and run a version
between 4.46.0 and 4.48.7 or any version of v5 up to and including
5.22.6 are required to update to versions 4.48.8 and 5.22.7.