CVE-2023-40028 PoC — Arbitrary file read via symlinks in Ghost

Source

Associated Vulnerability

Description

CVE-2023-40028 PoC Exploit

Readme

# CVE-2023-40028 PoC Exploit
Symlink Upload Vulnerability in Ghost CMS Leading to Arbitrary File Read

![POC Image](https://www.zyenra.com/assets/img/CVE-2023-40028/poc.png)

## Vulnerability Details

**CVE-2023-40028** is a vulnerability in **Ghost CMS** versions prior to **5.59.1**, where authenticated users can upload symbolic links (symlinks) that lead to arbitrary file reading on the host system.  The vulnerability can be exploited by leveraging the upload feature in Ghost CMS to place a symlink pointing to sensitive files. Once the symlink is uploaded, attackers can access the target file via a crafted HTTP request to the server.

## Exploit Usage

```bash
git clone https://github.com/rvizx/CVE-2023-40028
cd CVE-2023-40028
python3 exploit.py --url <http://target-ghost-cms> -u <username> -p <password>
```

## References

- [CVE-2023-40028 on Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40028)
- Credits - [PoC Exploit by 0xyassine](https://github.com/0xyassine/CVE-2023-40028/)

File Snapshot

 [4.0K]  /data/pocs/2bef51ad3eb550176442207a665126b936a46b73
├── [4.9K]  exploit.py
└── [1014]  README.md

0 directories, 2 files

Remarks