CVE-2024-23724 Ghost has possible Cross-site Scripting issue

What is CVE-2024-23724?

CVE-2024-23724 is a critical cross-site scripting vulnerability in n/a, published on 11 Feb 2024. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.

Official description

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that "The vendor does not view this as a valid vector."

Weakness: CWE-79

Which versions are affected by CVE-2024-23724?

3 open source packages ship an affected version, including ghost. It affects 1 product.

Products include Ghost Ghost.

How do I fix CVE-2024-23724?

Upgrade ghost to 5.82.11 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-23724 being exploited?

There is no known exploitation of CVE-2024-23724 in the wild and no public exploit code.

Public exploit code: 2 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2022-27139 Arbitrary file upload in Ghost Critical 9.8
• CVE-2022-28397 Arbitrary file upload in Ghost Critical 9.8
• CVE-2022-41654 ghost vulnerable to unauthorized newsletter modification via improper access controls Critical 9.6
• CVE-2026-26980 Ghost has a SQL Injection in its Content API Critical 9.4
• CVE-2024-34451 Security feature bypass in n/a Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-ghost-2024-23724, GHSA-99vc-xw8j-phjm.