CVE-2023-32235
📋 TL;DR
CVE-2023-32235 is a directory traversal vulnerability in Ghost CMS that allows remote attackers to read arbitrary files within the active theme's folder. Attackers can exploit this by manipulating URL paths to access files outside the intended directory. This affects all Ghost installations running versions before 5.42.1.
💻 Affected Systems
- Ghost CMS
📦 What is this software?
Ghost by Ghost
⚠️ Risk & Real-World Impact
Worst Case
Attackers could read sensitive configuration files, source code, or other theme-related files that might contain credentials, API keys, or other sensitive information stored in the theme directory.
Likely Case
Information disclosure of theme files, potentially exposing configuration details, custom code, or other files within the theme directory structure.
If Mitigated
Limited to reading files only within the theme directory, preventing access to system files or other critical directories.
🎯 Exploit Status
Exploitation requires only web access to the Ghost instance and knowledge of the vulnerable endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.42.1
Vendor Advisory: https://github.com/TryGhost/Ghost/commit/378dd913aa8d0fd0da29b0ffced8884579598b0f
Restart Required: Yes
Instructions:
1. Backup your Ghost installation and database. 2. Update Ghost to version 5.42.1 or later using your package manager or deployment method. 3. Restart the Ghost service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Web server path restriction
allConfigure web server (nginx/apache) to block requests containing directory traversal sequences to the /assets/ endpoint
# nginx example: location ~* ^/assets/.*\.\./ { deny all; }
# Apache example: RewriteRule ^assets/.*\.\./ - [F]
🧯 If You Can't Patch
- Implement WAF rules to block directory traversal patterns in URLs
- Restrict access to the Ghost instance using network controls or authentication
🔍 How to Verify
Check if Vulnerable:
Check Ghost version via admin panel or run: ghost versionCheck Version:
ghost versionVerify Fix Applied:
Confirm version is 5.42.1 or later and test that directory traversal attempts to /assets/built%2F..%2F..%2F/ return 404 or are blocked📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing /assets/built%2F..%2F..%2F/ patterns
- Multiple 404 errors with directory traversal sequences
Network Indicators:
- Unusual file access patterns to theme directories
- Requests with encoded directory traversal sequences
SIEM Query:
url:*assets/built*..* AND (status:200 OR status:404)