CVE-2024-23724

Vulnerability

Description

CVE-2024-23724 describes a stored cross-site scripting (XSS) vulnerability in the Ghost CMS platform, affecting versions through 5.76.0 [1][2]. The root cause lies in insufficient sanitization of SVG files uploaded as profile pictures. An attacker can embed arbitrary JavaScript code within an SVG image, which is then stored and served to other users (including administrators) without proper escaping or sanitization [1]. The Ghost project addressed this issue in a pull request that integrates the DOMPurify library to sanitize SVG content upon upload, preventing malicious script execution [2].

Attack

Vector

The attack requires a contributor-level account (the lowest privileged user with upload capabilities) or the ability to create one [1]. The attacker uploads a crafted SVG profile picture containing JavaScript that, when rendered by a victim's browser, communicates with the Ghost API running on localhost TCP port 3001 [1]. No user interaction beyond viewing the profile page or a page displaying the attacker's avatar is needed, making this a stored XSS vector that can trigger automatically.

Impact

Successful exploitation can lead to complete account takeover of any user who views the malicious SVG, including site administrators. The JavaScript can interact with the Ghost API from the victim's browser session, allowing the attacker to perform privileged actions such as changing passwords, modifying site content, or escalating the contributor's own privileges [1]. This bypasses standard same-origin restrictions because the attack targets a localhost port, which is considered local to the browser.

Mitigation

A fix was merged via pull request #19646, which introduces DOMPurify for server-side SVG sanitization [2]. Users should upgrade to Ghost version 5.76.1 or later as soon as possible. The vendor reportedly does not view this attack vector as valid due to the localhost port requirement, but the technical description from NVD and the project's own fix acknowledge the risk [1].