id: CVE-2021-29484

info:
  name: Ghost CMS <=4.32 - Cross-Site Scripting
  author: rootxharsh,iamnoooob
  severity: medium
  description: Ghost CMS 4.0.0 to 4.3.2 contains a DOM cross-site scripting vulnerability. An unused endpoint added during the development of 4.0.0 allows attackers to gain access by getting logged-in users to click a link containing malicious code.
  remediation: This issue has been fixed in 4.3.3.
  reference:
    - https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg
    - https://www.npmjs.com/package/ghost
    - https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290
    - https://nvd.nist.gov/vuln/detail/CVE-2021-29484
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N
    cvss-score: 6.8
    cve-id: CVE-2021-29484
    cwe-id: CWE-79
    epss-score: 0.01083
    epss-percentile: 0.82758
    cpe: cpe:2.3:a:ghost:ghost:*:*:*:*:*:node.js:*:*
  metadata:
    max-request: 1
    vendor: ghost
    product: ghost
    framework: node.js
  tags: cve,cve2021,xss,ghost

http:
  - method: GET
    path:
      - "{{BaseURL}}/ghost/preview"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'XMLHttpRequest.prototype.open'

      - type: word
        part: header
        words:
          - 'text/html'

      - type: status
        status:
          - 200

# digest: 4a0a00473045022100f375fb1ff2f8eb58f5577a223b800f98c3a91bf2417a0db1e98eac0bedf733be022053401ffa675389c892c9037a87181bfb66296036bf167260f48949ff739d8828:922c64590222798bb761d5b6d8e72950