Ghost Media Inliner SSRF Vulnerability Allowing Data Exfiltration

A server-side request forgery (SSRF) vulnerability has been identified in the media inliner feature of Ghost, a Node.js content management system. This issue affects Ghost versions 5.38.0 through 5.130.5 and 6.0.0 through 6.10.3. The vulnerability allows staff users with a valid authentication token for the Ghost Admin API to exfiltrate data from internal systems by crafting URLs for media assets that, when processed by the media inliner, access internal resources.

Impact

Exploitation of this vulnerability could lead to unauthorized access and exfiltration of internal data via SSRF.

Reproduction

To reproduce this vulnerability, a staff user with a valid authentication token for the Ghost Admin API can create a post that includes URLs pointing to internal resources. When the post is processed through the media inliner, the internal data can be accessed and exfiltrated.

Remediation

Users can upgrade to Ghost versions 5.130.6 or 6.11.0 to address this vulnerability.