-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| ghost | npm | >= 6.0.0, <= 6.10.3 | 6.11.0 |
| ghost | npm | >= 5.105.0, <= 5.130.5 | 5.130.6 |
Miggo AIRoot Cause AnalysisThe vulnerability lies in a middleware function within Ghost's admin API that is responsible for checking permissions for staff tokens. The analysis of the provided patches (commits 9513d2a35c21067127ce8192443d8919ddcefcc8 and c3017f81a5387b253a7b8c1ba1959d430ee536a3) reveals that the core issue was an improper URL path comparison. The vulnerable code only checked for paths with a trailing slash (e.g., /db/ and /users/owner/) when blocking sensitive operations for staff tokens. An attacker could simply make a request to the same path without the trailing slash (e.g., /db) to bypass this security check. This would grant unauthorized access to critical functionality such as deleting all content or transferring ownership of the site. The patches fix this by explicitly checking for the path both with and without the trailing slash. The vulnerable function is identified as tokenPermissionCheck in one version and notImplemented in another, both located in ghost/core/core/server/web/api/endpoints/admin/middleware.js. Both function names are included as they represent the vulnerable logic in different versions of the codebase.
tokenPermissionCheckghost/core/core/server/web/api/endpoints/admin/middleware.js
notImplementedghost/core/core/server/web/api/endpoints/admin/middleware.js