Summary
Ghost stored certain uploaded SVG files without sanitization when their filenames used a non-SVG extension, enabling scripts to execute from the site's domain. A staff user, including a Contributor, could abuse this behavior to target other staff members and potentially compromise their administrative sessions.
Ghost stored certain uploaded SVG files without sanitization when their filenames used a non-SVG extension, enabling scripts to execute from the site's domain. A staff user, including a Contributor, could abuse this behavior to target other staff members and potentially compromise their administrative sessions.
Affected context
The issue occurs in Ghost deployments that allow staff users to upload media and that process SVG thumbnails or SVG content uploaded with a non-SVG file extension. Risk is higher when uploaded content is served from the primary site origin and can be viewed by other staff users in an authenticated administrative context.
The issue occurs in Ghost deployments that allow staff users to upload media and that process SVG thumbnails or SVG content uploaded with a non-SVG file extension. Risk is higher when uploaded content is served from the primary site origin and can be viewed by other staff users in an authenticated administrative context.
Exploit preconditions
- Attack surface: Staff-facing media upload and content-serving functionality
- Required access: An authenticated staff account with permission to upload media, including a Contributor-level account where enabled
- Trigger point: A vulnerable SVG file is stored and later rendered or visited by another staff user
- Why exploitation is possible: Uploaded SVG content is retained without adequate sanitization and may execute as script when served from a trusted site origin
- Attack surface: Staff-facing media upload and content-serving functionality
- Required access: An authenticated staff account with permission to upload media, including a Contributor-level account where enabled
- Trigger point: A vulnerable SVG file is stored and later rendered or visited by another staff user
- Why exploitation is possible: Uploaded SVG content is retained without adequate sanitization and may execute as script when served from a trusted site origin
Why this happens
The underlying issue is insufficient output and upload validation for active SVG content. SVG files can contain script-capable markup, and storing or serving them without sanitization allows attacker-controlled content to execute in a browser context associated with the site's origin. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, with a related CWE-434: Unrestricted Upload of File with Dangerous Type condition.
The underlying issue is insufficient output and upload validation for active SVG content. SVG files can contain script-capable markup, and storing or serving them without sanitization allows attacker-controlled content to execute in a browser context associated with the site's origin. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation, with a related CWE-434: Unrestricted Upload of File with Dangerous Type condition.
Potential impact
- An attacker could execute script in another staff user's browser session
- Administrative session data could be exposed or abused
- Unauthorized actions could be performed with a victim's privileges
- Site content, settings, or user accounts could be modified
- The site's trust boundary could be used to distribute malicious content
- An attacker could execute script in another staff user's browser session
- Administrative session data could be exposed or abused
- Unauthorized actions could be performed with a victim's privileges
- Site content, settings, or user accounts could be modified
- The site's trust boundary could be used to distribute malicious content
General mitigation guidance
Mitigation generally focuses on treating SVG uploads as active content rather than ordinary images.
Common defensive patterns include:
- Sanitizing SVG content with an allowlisted, security-focused policy before storage or delivery
- Rejecting SVG uploads when they are not required for business functionality
- Validating file content by signature and parsing behavior instead of trusting extensions or MIME types
- Serving user-uploaded content from an isolated origin without access to administrative cookies
- Applying restrictive content security policies and safe response headers
- Limiting upload permissions according to least privilege
- Separating media storage from authenticated administrative origins where practical
Mitigation generally focuses on treating SVG uploads as active content rather than ordinary images.
Common defensive patterns include:
- Sanitizing SVG content with an allowlisted, security-focused policy before storage or delivery
- Rejecting SVG uploads when they are not required for business functionality
- Validating file content by signature and parsing behavior instead of trusting extensions or MIME types
- Serving user-uploaded content from an isolated origin without access to administrative cookies
- Applying restrictive content security policies and safe response headers
- Limiting upload permissions according to least privilege
- Separating media storage from authenticated administrative origins where practical
How teams detect issues like this
Organizations commonly detect this class of issue through:
- Static analysis and code review checks for unsanitized SVG handling and direct user-controlled file serving
- Review of upload paths that trust extensions, MIME types, or thumbnail-generation inputs
- Dynamic testing that verifies active content is neutralized before storage and rendering
- Monitoring for unexpected SVG uploads, unusual file extensions, and access patterns involving staff pages
- Policy enforcement requiring isolated origins and safe content-disposition behavior for user-uploaded files
- Automated security review tools that identify dangerous upload types and browser-executable content paths
Organizations commonly detect this class of issue through:
- Static analysis and code review checks for unsanitized SVG handling and direct user-controlled file serving
- Review of upload paths that trust extensions, MIME types, or thumbnail-generation inputs
- Dynamic testing that verifies active content is neutralized before storage and rendering
- Monitoring for unexpected SVG uploads, unusual file extensions, and access patterns involving staff pages
- Policy enforcement requiring isolated origins and safe content-disposition behavior for user-uploaded files
- Automated security review tools that identify dangerous upload types and browser-executable content paths
