GHSA-65p7-pjj8-ggmr Member account takeover
Unauthenticated attackers can take over member accounts by changing their email addresses via a vulnerable API endpoint in Ghost.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-65p7-pjj8-ggmr?
GHSA-65p7-pjj8-ggmr is an authentication bypass vulnerability in ghost, published on 23 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
An error in the implementation of the member email change functionality allows unauthenticated users to change the email address of arbitrary member accounts to one they control by crafting a request to the relevant API endpoint, and validating the new address via magic link sent to the new email address.
Ghost(Pro) has already been patched. Self-hosters are impacted if running Ghost a version between 3.18.0 and 4.15.0 with members functionality enabled.
Patches
Fixed in 4.15.1, all 4.x sites should upgrade as soon as possible. Fixed in 3.42.6, all 3.x sites should upgrade as soon as possible.
Workarounds
The patch in 4.15.1 and 3.42.6 adds a new authenticated endpoint for updating member email addresses. Updating Ghost is the quickest complete solution.
As a workaround, if for any reason you cannot update your Ghost instance, you can block the POST /members/api/send-magic-link/ endpoint, which will also disable member login and signup for your site.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected]
Which versions are affected by GHSA-65p7-pjj8-ggmr?
4 open source packages ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost npm | From 3.18.0 | 3.42.6 |
ghost npm | From 3.18.0 | 3.42.6 |
ghost npm | From 4.0.0 | 4.15.1 |
ghost npm | From 4.0.0 | 4.15.1 |
How do I fix GHSA-65p7-pjj8-ggmr?
Upgrade ghost to a fixed version for your release line: 3.42.6 or 4.15.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is GHSA-65p7-pjj8-ggmr being exploited?
There is no known exploitation of GHSA-65p7-pjj8-ggmr in the wild and no public exploit code.