CVE-2023-40028 PoC — Arbitrary file read via symlinks in Ghost

Source

https://github.com/sudlit/CVE-2023-40028

Associated Vulnerability

Title:Arbitrary file read via symlinks in Ghost (CVE-2023-40028)
Description:Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Readme

# Proof of Concept (PoC) for CVE-2023-40028

CVE-2023-40028 is a **vulnerability in Ghost CMS that allows arbitrary file reads through improper file handling.** This PoC demonstrates how the exploit works under controlled conditions. **Educational use only.**

**Reference:** Adapted from the original PoC by [0xyassine](https://github.com/0xyassine/CVE-2023-40028), rewritten in Python and applied to the HackTheBox challenge "LinkVortex."

### Summary:

1. **Vulnerability:** Arbitrary file read in Ghost CMS.
2. **Impact:** Access to sensitive files on the server.
3. **Fix:** Update to the latest Ghost CMS version.

**Usage:**
```
python3 ./CVE-2023-40028.py --url <http://abc.xyz> -u <username> -p <password>
```

**Use this information responsibly. Unauthorized exploitation is illegal.**

File Snapshot


 [4.0K]  /data/pocs/5ea1d6fb68df32c63b09a02234a6db715ae2e32b
├── [3.7K]  CVE-2023-40028.py
└── [ 797]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!