40 lines
1.2 KiB
YAML
40 lines
1.2 KiB
YAML
id: CVE-2021-29484
|
|
|
|
info:
|
|
name: DOM XSS in Ghost CMS
|
|
author: rootxharsh,iamnoooob
|
|
severity: medium
|
|
description: Ghost is a Node.js CMS. An unused endpoint added during the development of 4.0.0 has left sites vulnerable to untrusted users gaining access to Ghost Admin. Attackers can gain access by getting logged in users to click a link containing malicious code. Users do not need to enter credentials and may not know they've visited a malicious site.
|
|
reference:
|
|
- https://github.com/TryGhost/Ghost/security/advisories/GHSA-9fgx-q25h-jxrg
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2021-29484
|
|
- https://www.npmjs.com/package/ghost
|
|
- https://forum.ghost.org/t/critical-security-update-available-for-ghost-4-x/22290
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
|
|
cvss-score: 6.1
|
|
cve-id: CVE-2021-29484
|
|
cwe-id: CWE-79
|
|
tags: cve,cve2021,xss,ghost
|
|
|
|
requests:
|
|
- method: GET
|
|
path:
|
|
- "{{BaseURL}}/ghost/preview"
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: word
|
|
words:
|
|
- 'XMLHttpRequest.prototype.open'
|
|
part: body
|
|
|
|
- type: word
|
|
words:
|
|
- 'text/html'
|
|
part: header
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|