Summary
Ghost contains a stored cross-site scripting vulnerability in bookmark card image fetching. A staff user, including a Contributor, may cause non-image content from an external site to be stored and later rendered as bookmark imagery, allowing script-capable content to affect other staff users' administrative sessions.
Affected context
The issue occurs in Ghost installations that support bookmark cards and fetch externally hosted content for icons or thumbnails. It becomes risky when a staff user can create or edit bookmark cards, the fetched response is not reliably restricted to image content, and the stored result is later displayed within the administrative interface to other staff users.
Exploit preconditions
- Attack surface: Ghost bookmark card creation and image-fetching functionality
- Required access: Staff-level access capable of creating or modifying bookmark cards; Contributors may be sufficient
- Trigger point: Processing and later rendering of externally sourced bookmark imagery in the administration interface
- Why exploitation is possible: Content that is not a valid image may be accepted, stored, and interpreted in a browser context where other staff users view the affected card
Why this happens
The underlying flaw is insufficient validation and output handling of externally fetched bookmark card content. The application treats a remote response as image data without enforcing a trustworthy media type and safe rendering boundary, allowing stored content to reach staff-facing pages in an executable browser context. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), specifically a stored XSS pattern.
Potential impact
- An attacker may execute script in another staff user's browser context
- Administrative sessions or sensitive interface data could be exposed
- Unauthorized actions could be performed with the victim's privileges
- Site content, settings, or integrations could be modified
- The vulnerability could facilitate further compromise of privileged accounts
General mitigation guidance
Mitigation generally focuses on enforcing a strict trust boundary for externally fetched bookmark assets and ensuring that stored content cannot become executable markup.
Common defensive patterns include:
- Accepting only validated image formats and trusted media types
- Verifying fetched content independently of attacker-controlled headers or file names
- Storing and serving assets through a safe, non-executable media path
- Applying context-appropriate output encoding and sanitization
- Using restrictive content security policies where practical
- Limiting staff privileges and reducing the impact of compromised administrative sessions
- Preventing unnecessary server-side fetching of arbitrary external resources
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis rules covering unsafe HTML insertion and insufficient output encoding
- Code review checks for remote-content fetching, MIME-type validation, and media storage boundaries
- Tests using non-image responses and browser rendering checks in administrative views
- Monitoring bookmark metadata and fetched asset records for unexpected content types or origins
- Policy enforcement requiring allowlisted domains or validated media pipelines for externally sourced assets
- Automated security review tools that identify stored XSS sinks and unsafe content handling
