CVE-2023-40028 PoC — Arbitrary file read via symlinks in Ghost

Description

CVE-2023-40028 is a security vulnerability affecting Ghost CMS versions prior to 5.59.1.

Readme

# CVE-2023-40028: Ghost CMS Symlink Exploitation (PoC)

## Overview

This repository contains a **Proof-of-Concept (PoC)** script designed to demonstrate the exploitation of **CVE-2023-40028**, a Local File Inclusion (LFI) vulnerability affecting **Ghost CMS versions prior to 5.59.1**. The vulnerability allows authenticated users to upload files that are symbolic links (symlinks), enabling attackers to access arbitrary files on the host system.

This PoC script will show how an attacker can upload a crafted zip file containing a symlink pointing to sensitive system files, potentially leading to information disclosure.

> **Disclaimer:**  
> This script is for educational and research purposes only. It is the user's responsibility to ensure they have permission to test the targeted systems. Unauthorized access to systems is illegal and unethical. Always obtain explicit permission before testing systems for vulnerabilities.

## Vulnerability Details

- **CVE ID**: CVE-2023-40028
- **Vulnerability Type**: Local File Inclusion (LFI)
- **Affected Product**: Ghost CMS (versions prior to 5.59.1)
- **Impact**: Attackers can upload symbolic link files to access sensitive system files on the server.
- **Fix**: Ghost CMS released version 5.59.1 to address this vulnerability.

### CVE-2023-40028 Summary:
The vulnerability exists due to improper handling of file uploads in Ghost CMS. Authenticated users can upload symbolic link files, which can be used to access sensitive files outside of the CMS’s intended directories.

## Prerequisites

Before using this PoC script, ensure you meet the following requirements:

- A running instance of **Ghost CMS** prior to version 5.59.1.
- An authenticated admin account for the Ghost CMS instance you are targeting.
- Python 3.x installed on your local system.
- Required Python libraries:
  - `requests`
  - `argparse`
  - `json`
  - `os`
  - `shutil`
  - `time`

You can install the required libraries using pip:
```bash
pip install requests

File Snapshot

Remarks