CVE-2021-29484: Ghost CMS Unauthenticated Access to Admin Panel
Summary
CVE-2021-29484: DOM XSS in Theme Preview. Affects ghost versions >= 4.0.0, < 4.3.3. Fixed in 4.3.3. How to fix ↓
Also tracked for
- ghost · npm
The same CVE-2021-29484 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Ghost is a popular Node.js CMS used for creating and managing websites. It provides a user-friendly interface for content creation and management. However, a vulnerability has been discovered in versions 4.0.0 to 4.3.2 of Ghost, which allows untrusted users to gain unauthorized access to the Ghost Admin panel. This vulnerability was introduced during the development of version 4.0.0 and remained unnoticed until now. Ghost(Pro) has already been patched, but self-hosted instances of Ghost running the affected versions are at risk.
Vulnerability Detail
The vulnerability in Ghost CMS allows attackers to gain access to the Ghost Admin panel without requiring any credentials. By tricking logged-in users into clicking a malicious link, attackers can execute arbitrary code and potentially perform unauthorized actions within the CMS. This vulnerability can be exploited by users who are unaware that they have visited a malicious site. The issue has been fixed in version 4.3.3 by removing the unused endpoint that was responsible for the vulnerability.
How To Fix
Minimum fixed version
4.3.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can block access to the '/ghost/preview' endpoint to mitigate the risk of exploitation. This can be done by configuring your web server or firewall to deny requests to this specific URL. However, this is not a permanent solution, and upgrading to the latest version of Ghost CMS is strongly recommended.
Conclusion
The vulnerability in Ghost CMS allows untrusted users to gain unauthorized access to the Ghost Admin panel. It is crucial to upgrade to version 4.3.3 or later to fix this vulnerability and ensure the security of your Ghost CMS installation. Blocking access to the '/ghost/preview' endpoint can provide temporary mitigation, but it is not a permanent solution. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for ghost →
FAQ
Ghost CMS is a Node.js-based content management system designed for creating and managing websites.
The vulnerability allows untrusted users to gain unauthorized access to the Ghost Admin panel, potentially leading to unauthorized actions within the CMS.
No, Ghost(Pro) has already been patched and is not affected by this vulnerability.
Versions 4.0.0 to 4.3.2 of Ghost CMS are affected by this vulnerability.
To secure your Ghost CMS installation, it is recommended to upgrade to version 4.3.3 or later. Additionally, you can block access to the '/ghost/preview' endpoint as a temporary workaround.
Related vulnerabilities
Recent vulnerabilities recorded for ghost.
