CVE-2023-40028: Ghost arbitrary file read

Proof of concept for CVE-2023-40028, an authenticated arbitrary file-read vulnerability in Ghost's content import feature. A crafted ZIP archive creates a symlink under content/images, allowing the script to request a file from the Ghost host.

Ghost versions before 5.59.1 are affected. Upgrade to 5.59.1 or later.

Use this only against systems you own or are authorized to test.

Requirements

• Python 3
• requests
• Ghost administrator credentials or a valid ghost-admin-api-session cookie

python3 -m venv .venv
source .venv/bin/activate
python -m pip install requests

Usage

Read one file with a username and password:

python3 ghost_fileread.py \
  --url https://ghost.example \
  --username [email protected] \
  --password 'password' \
  --file /etc/passwd

Use an existing admin session cookie:

python3 ghost_fileread.py \
  --url https://ghost.example \
  --cookie 'session-cookie-value' \
  --file /var/lib/ghost/config.production.json

Omit --file to open the interactive file> prompt. Run python3 ghost_fileread.py --help for proxy, timeout, and User-Agent options.

The endpoint returns text, so this tool is intended for text files. Importing the crafted archive leaves a symlink in the target's content/images directory.

References

• GitHub advisory: CVE-2023-40028
• Ghost fix