Arbitrary File Read in Ghost CMS via CVE-2023-40028

CVE-2023-40028 is an arbitrary file read vulnerability affecting Ghost CMS versions prior to 5.59.1. The vulnerability arises from improper validation during file upload, allowing an authenticated attacker with administrative privileges to upload files as symbolic links. By manipulating these links, an attacker can bypass directory restrictions and access arbitrary files on the host operating system. This vulnerability has been categorized with a CVSS score of 6.5 (Medium). Proof-of-concept exploit code has been published publicly, demonstrating that the attack chain leverages the /ghost/api/v3/admin/session/ endpoint for initial authentication, followed by the malicious upload process. Defenders should prioritize patching Ghost CMS to version 5.59.1 or later.

Impact

Successful exploitation of this vulnerability allows unauthorized access to sensitive files residing on the host server. Depending on the server configuration and file permissions, this could lead to the exposure of configuration files, environment variables, or other sensitive system data. Organizations utilizing versions of Ghost CMS older than 5.59.1 are at risk, particularly if administrative accounts are compromised.

Recommendation

• Patch Ghost CMS to version 5.59.1 or later immediately as the primary mitigation.
• Audit the content/ directory of Ghost CMS installations to identify and remove any unauthorized symbolic links.
• Monitor administrative authentication logs for suspicious activity, particularly around the /ghost/api/v3/admin/session/ endpoint, to detect account misuse.
• Implement strict ingress filtering and restrict administrative access to trusted management IP ranges to limit the risk of exploitation by unauthorized actors.