CyberRota Analysis
AI-GeneratedGhost, a Node.js content management system, is vulnerable to a Server-Side Request Forgery (SSRF) flaw that affects versions from 0.10.0 to 6.54.1, allowing staff-level users to execute blind HTTP GET requests against internal hosts. While no output is returned, this vulnerability could be exploited to probe open ports on internal systems, potentially leading to further attacks. Organizations using affected versions should prioritize updating to version 6.54.1 to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Ghost is a Node.js content management system. From 0.10.0 until 6.54.1, a Server-Side Request Forgery in Ghost Admin image fetching allowed any staff-level user to perform a blind HTTP GET request against internal hosts. No output was returned, but this could have been used to probe open ports on internal hosts. This issue is fixed in version 6.54.1.