CVE-2023-40028 Arbitrary file read via symlinks in Ghost
Authenticated users can upload symlinks to read arbitrary files on the host system in Ghost CMS.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40028?
CVE-2023-40028 is a medium-severity path traversal vulnerability in TryGhost Ghost, published on 15 Aug 2023. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Which versions are affected by CVE-2023-40028?
3 open source packages ship an affected version, including ghost. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ghost Bitnami | All versions | 5.59.1 |
ghost npm | All versions | 5.59.1 |
ghost npm | All versions | 5.59.1 |
Products include Ghost Ghost.
How do I fix CVE-2023-40028?
Upgrade ghost to 5.59.1 or later.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2023-40028 being exploited?
There is no known exploitation of CVE-2023-40028 in the wild and no public exploit code.
Public exploit code: 1 Exploit-DB entry and 10 proofs of concept on GitHub.
Other vulnerabilities in TryGhost Ghost
Sources
Also known as BIT-ghost-2023-40028, GHSA-9c9v-w225-v5rg.