CVE-2023-40028 PoC — Arbitrary file read via symlinks in Ghost

Source

https://github.com/0xyassine/CVE-2023-40028

Associated Vulnerability

Title:Arbitrary file read via symlinks in Ghost (CVE-2023-40028)
Description:Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. Site administrators can check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Readme

# CVE-2023-40028 Proof of Concept

This repository contains a proof of concept (POC) for CVE-2023-40028, demonstrating a vulnerability in the Ghost content management system where authenticated users can upload symlinks, leading to arbitrary file read vulnerabilities.

## Disclaimer

This POC is provided for educational and research purposes only. It is strictly forbidden to use this POC for illegal activities. The author of this POC assume no liability and is not responsible for any misuse or damage caused by this program.

## Vulnerability Summary

CVE-2023-40028 affects Ghost, an open source content management system, where versions prior to 5.59.1 allow authenticated users to upload files that are symlinks. This can be exploited to perform an arbitrary file read of any file on the host operating system. It is recommended that site administrators check for exploitation of this issue by looking for unknown symlinks within Ghost's `content/` folder. Version 5.59.1 contains a fix for this issue, and there are no known workarounds.

- **CVE ID**: CVE-2023-40028
- **CVSS Score**: 6.5 Medium
- **Affected Software**: Ghost versions before 5.59.1
- **Fixed in Version**: Ghost 5.59.1

## POC Overview

This POC demonstrates how to exploit CVE-2023-40028 by uploading a symlink to the vulnerable Ghost CMS to achieve arbitrary file read.

## Requirements

- Access to a vulnerable Ghost version (prior to 5.59.1)
- Authenticated user account

## Mitigation

Upgrade to Ghost version 5.59.1 or later, which contains the patch for this vulnerability. Regularly check your Ghost installation's `content/` folder for any unknown symlinks and remove them.

## References

- [CVE-2023-40028 on OpenCVE](https://www.opencve.io/cve/CVE-2023-40028)
- [CVE-2023-40028 on Mitre](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-40028)

For more detailed information about CVE-2023-40028, including the vulnerability details and mitigation advice, please refer to the provided references.

File Snapshot


 [4.0K]  /data/pocs/cda1775daef36f9d8317c61058b24cd93956f3be
├── [2.7K]  CVE-2023-40028.sh
└── [1.9K]  README.md

0 directories, 2 files

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!