CVE-2021-29484 DOM XSS in Theme Preview
Attackers can hijack Ghost Admin sessions via DOM XSS in an unused preview endpoint, requiring users to click a malicious link.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2021-29484?
CVE-2021-29484 is a medium-severity cross-site scripting vulnerability in TryGhost Ghost, published on 29 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site. Ghost(Pro) has already been patched. We can find no evidence that the issue was exploited on Ghost(Pro) prior to the patch being added. Self-hosters are impacted if running Ghost a version between 4.0.0 and 4.3.2. Immediate action should be taken to secure your site. The issue has been fixed in 4.3.3, all 4.x sites should upgrade as soon as possible. As the endpoint is unused, the patch simply removes it. As a workaround blocking access to /ghost/preview can also mitigate the issue.
Weakness: CWE-79
Which versions are affected by CVE-2021-29484?
3 open source packages ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | From 4.0.0 | 4.3.3 |
ghost npm | From 4.0.0 | 4.3.3 |
ghost npm | From 4.0.0 | 4.3.3 |
Products include Ghost Ghost.
How do I fix CVE-2021-29484?
Upgrade ghost to 4.3.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2021-29484 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-29484 exists.
Public exploit code: 1 Nuclei template.
Other vulnerabilities in TryGhost Ghost
Sources
Also known as BIT-ghost-2021-29484, GHSA-9fgx-q25h-jxrg.