CVE-2024-23724: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

February 11, 2024 (updated February 12, 2024)

Ghost through 5.76.0 allows stored XSS, and resultant privilege escalation in which a contributor can take over any account, via an SVG profile picture that contains JavaScript code to interact with the API on localhost TCP port 3001. NOTE: The discoverer reports that “The vendor does not view this as a valid vector.”

References

github.com/RhinoSecurityLabs/CVEs/tree/master/CVE-2024-23724
github.com/TryGhost/Ghost/pull/19646
github.com/advisories/GHSA-99vc-xw8j-phjm
nvd.nist.gov/vuln/detail/CVE-2024-23724
rhinosecuritylabs.com/blog

Code Behaviors & Features

Detect and mitigate CVE-2024-23724 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →