Installation

Automatic installation (recommended)

To test the vulnerability, we need two accounts: an account with the administrator role (owner) and an account with the contributor role. In Ghost CMS, you must first access the admin panel to create the owner account, then invite a contributor from that account so they can create their own account. However, in Ghost, the only way to invite a contributor is to send an invitation link by email, which requires an email delivery service to send the email to the contributor's account. To make things easier, we created a Mailgun account, added a contributor to Ghost, then created a database dump file in the state we had it. In our Docker Compose setup, we first ensure the database is restored from the dump before starting Ghost, so you don't need an email delivery service to test this vulnerability. However, if you wish to start with a clean installation and not use the provided database dump, you can use the Docker Compose in the manual-setup folder to start a clean Ghost installation. Below you will find the steps to configure Mailgun (an email delivery service we used) and make it work with Ghost. For this installation, here are the administrator and contributor credentials to use for logging in:

• Admin:
  • Email: [email protected]
  • Password: ZtXfMq2FaRHGm@!
• Contributor:
  • Email: [email protected]
  • Password: ZtXfMq2FaRHGm@!

Manual installation with Mailgun

To begin, you need to create a Mailgun account. Once your account is created, obtain your SMTP credentials. After obtaining your credentials, place them in the config.development.json file following the same format as shown in the config.example.json file.

Here is a step-by-step guide:

1. Create a Mailgun account at Mailgun.
2. Go to the SMTP credentials section in your Mailgun dashboard.
3. Copy your SMTP credentials.
4. Duplicate the config.example.json file and rename it to config.development.json.
5. Fill in your SMTP credentials in the config.development.json file. This will ensure your development environment is correctly configured to send emails via Mailgun.
6. If you created a Mailgun account, the default Mailgun domain you get is a sandbox domain, which means you need to authorize the contributor email you want to use to receive the contributor invitation link. You can do this in the Mailgun dashboard under (left sidebar) Send > Sending > Overview. Indeed, Mailgun will only send emails to authorized recipients when using a sandbox domain. When you add an authorized recipient, you will receive an email to confirm the authorization. After confirming the authorization, Ghost can now send emails to that recipient through Mailgun.
7. After creating an Owner account in Ghost by visiting http://localhost:3001/ghost and adding the contributor email to the authorized recipients list in Mailgun, you can now send an invitation link to the contributor at that email via Mailgun from http://localhost:3001/ghost/#/settings/staff.
8. You can now use the invitation link received in the email to create a contributor account. After that, you will have a setup identical to the one we use with the database restoration.

How to test the attack

You can launch the installation of your choice using the following command:

docker-compose up

To test the attack, follow these steps:

1. Generate the malicious SVG profile picture using the generate-malicious-svg.py script. To do this, run the following command, replacing [USERNAME] and [PASSWORD] with the credentials of the contributor account you created:

python generate-malicious-svg.py -u [USERNAME] -p [PASSWORD] -t http://localhost

For the automatic installation, the command is:

python generate-malicious-svg.py -u [email protected] -p ZtXfMq2FaRHGm@! -t http://localhost

This command generates a malicious SVG file named tenant-takeover.svg in the current directory.

2. Log in to the Ghost admin interface using the credentials of the contributor account you created. To do this, visit http://localhost:3001/ghost and log in with the contributor account credentials.

3. Access your profile edit page by clicking on your profile picture in the bottom left of the screen, then clicking the "Your profile" button.

4. Click on the profile icon to change your profile picture. Select the malicious SVG file you generated in step 1.

5. Save the changes by clicking the "Save & close" button. You can refresh the page to verify that the profile picture has been changed.

6. You can now log out of the contributor account and log in to the administrator account. Under http://localhost:3001/ghost/#/settings/staff?tab=contributors, you can see that the contributor's profile picture has been changed. If you right-click on the profile picture and open the image in a new tab, this will trigger the attack. You can now return to http://localhost:3001/ghost/#/settings/staff and you will see that the contributor is now the owner of the blog and you have become an administrator.

🎥 Explanatory Video

We made a video that describes in detail the entire process and the steps necessary to implement the CVE. This video serves as a visual guide to better understand our approach and the actions performed.

Link to the video: Click here to watch the video

Feel free to check out this video for a complete overview of the project and the technical steps followed.