Summary
Ghost can serve files uploaded by staff users with a content type derived from the file extension when the default local storage adapter is used. An attacker who can upload a script may host it on the site's domain, which could enable compromise of other staff users' administrative sessions.
Ghost can serve files uploaded by staff users with a content type derived from the file extension when the default local storage adapter is used. An attacker who can upload a script may host it on the site's domain, which could enable compromise of other staff users' administrative sessions.
Affected context
The issue occurs in Ghost deployments using the default local storage adapter during the affected 6.22.1 through 6.64.0 release range. In this context, the protection intended to prevent browsers from executing uploaded content is not consistently applied, allowing the response content type to be inferred from a file's extension.
The issue occurs in Ghost deployments using the default local storage adapter during the affected 6.22.1 through 6.64.0 release range. In this context, the protection intended to prevent browsers from executing uploaded content is not consistently applied, allowing the response content type to be inferred from a file's extension.
Exploit preconditions
- Attack surface: Ghost's staff-facing file upload functionality and local file-serving path
- Required access: A staff account or other permission capable of uploading files
- Trigger point: A browser requests an uploaded file from the site's domain
- Why exploitation is possible: The local storage path may return an extension-derived content type instead of a restrictive type, allowing browser interpretation of uploaded content as an executable script
- Attack surface: Ghost's staff-facing file upload functionality and local file-serving path
- Required access: A staff account or other permission capable of uploading files
- Trigger point: A browser requests an uploaded file from the site's domain
- Why exploitation is possible: The local storage path may return an extension-derived content type instead of a restrictive type, allowing browser interpretation of uploaded content as an executable script
Why this happens
The underlying flaw is inconsistent enforcement of safe content types for user-uploaded files. Although Ghost restricted content types in the relevant serving flow, the default local storage adapter did not apply the same protection and derived the response type from the file extension. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), with a related CWE-434: Unrestricted Upload of File with Dangerous Type condition.
The underlying flaw is inconsistent enforcement of safe content types for user-uploaded files. Although Ghost restricted content types in the relevant serving flow, the default local storage adapter did not apply the same protection and derived the response type from the file extension. This maps primarily to CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), with a related CWE-434: Unrestricted Upload of File with Dangerous Type condition.
Potential impact
- A malicious staff user may host executable script content on the site's origin.
- Other staff users' administrative sessions could be exposed or compromised.
- An attacker could perform actions in the context of a victim's authenticated Ghost session.
- Site content, settings, or administrative data could be altered depending on the victim's privileges.
- A malicious staff user may host executable script content on the site's origin.
- Other staff users' administrative sessions could be exposed or compromised.
- An attacker could perform actions in the context of a victim's authenticated Ghost session.
- Site content, settings, or administrative data could be altered depending on the victim's privileges.
General mitigation guidance
Mitigation generally focuses on treating uploaded files as untrusted content and enforcing safe serving behavior across every storage adapter.
Common defensive patterns include:
- Serve user-uploaded content with a non-executable, restrictive content type.
- Apply consistent response-header policies across local and remote storage implementations.
- Validate permitted file types using trusted content inspection rather than extensions alone.
- Store uploads on an isolated origin or separate host where practical.
- Restrict upload permissions to the minimum staff roles that require them.
- Use browser isolation controls such as appropriate content security policies where compatible.
Mitigation generally focuses on treating uploaded files as untrusted content and enforcing safe serving behavior across every storage adapter.
Common defensive patterns include:
- Serve user-uploaded content with a non-executable, restrictive content type.
- Apply consistent response-header policies across local and remote storage implementations.
- Validate permitted file types using trusted content inspection rather than extensions alone.
- Store uploads on an isolated origin or separate host where practical.
- Restrict upload permissions to the minimum staff roles that require them.
- Use browser isolation controls such as appropriate content security policies where compatible.
How teams detect issues like this
Organizations can assess this class of issue through:
- Static and configuration analysis for extension-derived content types on upload-serving routes.
- Code review of storage adapters, upload validation, and response-header generation.
- Tests that verify dangerous or ambiguous uploads are served as downloads or with non-executable types.
- Monitoring for unexpected script-like files, unusual upload activity, and requests to newly uploaded resources.
- Policy checks requiring uploaded content to be isolated from privileged application origins.
Automated security review tools may help identify unrestricted upload paths and inconsistent MIME-type enforcement.
Organizations can assess this class of issue through:
- Static and configuration analysis for extension-derived content types on upload-serving routes.
- Code review of storage adapters, upload validation, and response-header generation.
- Tests that verify dangerous or ambiguous uploads are served as downloads or with non-executable types.
- Monitoring for unexpected script-like files, unusual upload activity, and requests to newly uploaded resources.
- Policy checks requiring uploaded content to be isolated from privileged application origins.
Automated security review tools may help identify unrestricted upload paths and inconsistent MIME-type enforcement.
