CVE-2022-28397

Vulnerability

An arbitrary file upload vulnerability exists in the file upload module of Ghost CMS version 4.42.0 [1]. The vulnerability allows an attacker to upload a crafted file that can lead to arbitrary code execution. Only trusted users with the ability to upload files can exploit this issue [2].

Exploitation

An attacker must have a trusted user account (e.g., admin or editor) on the Ghost CMS instance. The attacker can then upload a malicious file (such as a PHP script or executable) via the file upload module. The file is stored on the server and can be accessed and executed, leading to code execution [1]. No further user interaction is required once the file is uploaded [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code on the server with the privileges of the web server process. This can lead to full compromise of the Ghost CMS instance, including data disclosure, modification, or further lateral movement [1]. The vendor notes that this behavior is intentional because file uploads are restricted to trusted users who already have high-level access [2].

Mitigation

No official patch has been released as the vendor considers the vulnerability by design [2]. Users should limit the number of trusted user accounts and review file upload permissions. Restrict file types and monitor uploaded files for malicious content. Consider using a web application firewall (WAF) to detect and block malicious uploads [1].