nuclei-templates/cves/2021/CVE-2021-29484.yaml

id: CVE-2021-29484

info:
  name: DOM XSS in Ghost CMS
  author: rootxharsh,iamnoooob
  description: Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site.
  severity: medium
  tags: cve,cve2021,xss,ghost
  reference:
    - https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg
    - https://nvd.nist.gov/vuln/detail/CVE-2021-29484

requests:
  - method: GET
    path:
      - "{{BaseURL}}/ghost/preview"

    matchers-condition: and
    matchers:
      - type: word
        words:
          - 'XMLHttpRequest.prototype.open'
        part: body

      - type: word
        words:
          - 'text/html'
        part: header

      - type: status
        status:
          - 200
Add CVE-2021-29484.yaml 2021-08-01 18:24:52 +00:00			`id: CVE-2021-29484`

			`info:`
			`name: DOM XSS in Ghost CMS`
Adding metadata 2021-08-02 17:46:05 +00:00			`author: rootxharsh,iamnoooob`
			`description: Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site.`
Add CVE-2021-29484.yaml 2021-08-01 18:24:52 +00:00			`severity: medium`
Adding metadata 2021-08-02 17:46:05 +00:00			`tags: cve,cve2021,xss,ghost`
Removed pipe (\|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84 2021-08-19 13:59:12 +00:00			`reference:`
Satisfying the linter (all errors and warnings) * whitespace modifications only 2021-08-19 14:44:46 +00:00			`- https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg`
			`- https://nvd.nist.gov/vuln/detail/CVE-2021-29484`
Add CVE-2021-29484.yaml 2021-08-01 18:24:52 +00:00
			`requests:`
Update cves/2021/CVE-2021-29484.yaml Co-authored-by: Toufik Airane <toufik.airane@appsectribe.com> 2021-08-02 17:35:35 +00:00			`- method: GET`
			`path:`
			`- "{{BaseURL}}/ghost/preview"`
Add CVE-2021-29484.yaml 2021-08-01 18:24:52 +00:00
			`matchers-condition: and`
			`matchers:`
			`- type: word`
			`words:`
			`- 'XMLHttpRequest.prototype.open'`
			`part: body`

			`- type: word`
			`words:`
			`- 'text/html'`
			`part: header`

			`- type: status`
			`status:`
			`- 200`