GHSA-wfrj-qqc2-83cm Remote command injection when using sendmail email transport
Remote attackers can execute arbitrary commands on Ghost sites configured to use the sendmail email transport.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-wfrj-qqc2-83cm?
GHSA-wfrj-qqc2-83cm is a command injection vulnerability in ghost, published on 20 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Sites using the sendmail transport as part of their mail config are vulnerable to remote command injection due to a vulnerability in the nodemailer dependency.
Ghost defaults to the direct transport so this is only exploitable if the sendmail transport is explicitly used.
Patches
Fixed in 4.15.0, all sites should upgrade as soon as possible.
Workarounds
- Use an alternative email transport as described in the docs.
For more information
If you have any questions or comments about this advisory:
- email us at [email protected]
Which versions are affected by GHSA-wfrj-qqc2-83cm?
2 open source packages ship an affected version, including ghost.
| Package | Affected | Fixed in |
|---|---|---|
ghost npm | All versions | 4.15.0 |
ghost npm | All versions | 4.15.0 |
How do I fix GHSA-wfrj-qqc2-83cm?
Upgrade ghost to 4.15.0 or later.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is GHSA-wfrj-qqc2-83cm being exploited?
There is no known exploitation of GHSA-wfrj-qqc2-83cm in the wild and no public exploit code.