Headline
CVE-2022-28397: Ghost Customers – A showcase of real sites built with Ghost
An arbitrary file upload vulnerability in the file upload module of Ghost CMS v4.42.0 allows attackers to execute arbitrary code via a crafted file.
Turn your audience into a business
Ghost gives creators tools to launch their own subscription business.
Memberships, subscriptions, and email newsletters, all in one place. Some of the most popular editorial newsletters in the world run on Ghost, including The Browser, with its 10,000+ paying subscribers.
Ghost is a complete platform to run an independent media business, whether you’re just getting started as a creator, or scaling to millions of dollars a year in recurring revenue.
Subscription business models have been incredibly successful in software, music and video streaming over the last few years. Now, anyone can launch their own subscription commerce service, and make a living from their creative work.
Who uses Ghost?
A powerful publishing platform, trusted by the world’s leading writers, creators, and professional content teams.
Ghost is used by teams who want full control of their content workflow, and are tired of fighting broken software. A clean editor, optimised publishing flow, native email newsletters, and total control of design are the biggest reasons for why teams trade in their old platform for Ghost.
Setting up a basic blog is easy, but if you’re creating content for work, and you need a reliable platform to build a business around, Ghost is the leading choice for professional online publishing.
Many of the world’s best content marketing teams, like Buffer, use Ghost to publish.
Why choose Ghost?
Privacy, security and speed are some of the most common reasons for why large companies and publications favour Ghost for their publishing needs.
We’ve found that most modern teams setting up new publications get given the same brief: Use an open platform which is stable, make sure it’s fast + SEO friendly, and make absolutely certain it’s not PHP. Ghost has quickly become the most popular platform to check all those boxes.
Enjoy a standard of technology which you normally only get building in-house: A Node.js core + a full JSON API with a permissive MIT License, all of which have received extensive independent security audits and penetration testing.
Ghost’s advantages attracted Elon Musk’s OpenAI team to publish all of their research using Ghost.
But what about Medium?
Medium is a great social network to use for promotion, while Ghost allows you to build out your own platform and your own audience.
When you’re building a publication you should always use social networks like Twitter, Facebook and Medium to promote your content & find new readers. But once you’ve got those readers: What next? Social networks give you zero control over your audience, and if they decide to change algorithms or disappear, then so does your readership.
You can loosely think of it like this: Social networks are like running ads or guest spot in somebody else’s magazine. By contrast, using Ghost is like creating your own magazine and owning the full, custom experience from cover to cover.
Multiple people on The Stanford Review team publish on Medium, but the newspaper has smartly built out its core publication on top of Ghost.
What’s the best way to run Ghost?
Ghost can either be run on our fully managed hosting, or directly integrated into your own infrastructure depending on what you prefer.
The majority of people tend to run Ghost on our fully managed PaaS called Ghost(Pro). This removes the headaches of server management, security monitoring and software updates completely — and allows you to focus on the other aspects of your business where time is better spent.
Some larger organisations such as Apple and Mozilla choose to run Ghost on their own private networks where they’re able to make some deep core modifications to the software in order suit specific use cases.
For these types of companies we’re always pleased to offer Enterprise Cloud contracts to ensure that their software is always secure, up to date, and running optimally.
Can I modify it for my needs?
Ghost has a very simple admin UI for a smooth user experience, but under the hood you still have full control over how it works.
Things like automatic XML sitemaps, RSS feeds and dedicated SEO & Structure Data meta fields mean that there’s a lot which Ghost just does for you, right out of the proverbial box. But it can also be adapted to suit a huge number of use cases.
Front end modifications for things like analytics, styling and scripts are easily done at a theme level. You can plug in multiple database via an ORM layer, while your file system can live almost anywhere using a custom storage adapter. Even integrating a full search index using something like Algolia is possible with a few tweaks.
Our friends over at Speedtest.net even run a modified base URL setup to serve their site on speedtest.net/insights rather than insights.speedtest.net.
What about design?
Create a custom design from scratch, choose a pre-made template, or modify our default theme to suit your style and brand.
Our theme API gives you full control over the look and feel of your publication, with a strong focus on both flexibility and performance. You can build a theme completely from scratch, or you can select one of the many pre-made templates available in our theme marketplace.
A fast-track to getting a new publication online is to use the Ghost default theme as a base and modify it to suit your brand. This allows you to get up and running with minimal fuss, benefitting from hundreds of hours of development already done for you. If that’s not for you, you can always start from ground zero and create a stunning custom publication like FullStory did.
Whatever you decide, you’re in the driver’s seat.
Ready to give it a try? Start a trial completely free for 14 days and build your publication
Related news
MariaDB Server v10.6.3 and below was discovered to contain an use-after-free in the component Item_func_in::cleanup(), which is exploited via specially crafted SQL statements.
An issue in the component Create_tmp_table::finalize of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Field::set_default of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Arg_comparator::compare_real_fixed of MariaDB Server v10.6.2 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Item_subselect::init_expr_cache_tracker of MariaDB Server v10.6 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
An issue in the component Used_tables_and_const_cache::used_tables_and_const_cache_join of MariaDB Server v10.7 and below was discovered to allow attackers to cause a Denial of Service (DoS) via specially crafted SQL statements.
MariaDB Server v10.6 and below was discovered to contain an use-after-free in the component my_strcasecmp_8bit, which is exploited via specially crafted SQL statements.
MariaDB Server v10.7 and below was discovered to contain a global buffer overflow in the component decimal_bin_size, which is exploited via specially crafted SQL statements.
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.
MinIO is a High Performance Object Storage released under GNU Affero General Public License v3.0. A security issue was found where an non-admin user is able to create service accounts for root or other admin users and then is able to assume their access policies via the generated credentials. This in turn allows the user to escalate privilege to that of the root user. This vulnerability has been resolved in pull request #14729 and is included in `RELEASE.2022-04-12T06-55-35Z`. Users unable to upgrade may workaround this issue by explicitly adding a `admin:CreateServiceAccount` deny policy, however, this, in turn, denies the user the ability to create their own service accounts as well.
An arbitrary file upload vulnerability in the file upload module of Strapi v4.1.5 allows attackers to execute arbitrary code via a crafted file.
An arbitrary file upload vulnerability in the file upload module of PayloadCMS v0.15.0 allows attackers to execute arbitrary code via a crafted SVG file.
Grafana is an open-source platform for monitoring and observability. When fine-grained access control is enabled and a client uses Grafana API Key to make requests, the permissions for that API Key are cached for 30 seconds for the given organization. Because of the way the cache ID is constructed, the consequent requests with any API Key evaluate to the same permissions as the previous requests. This can lead to an escalation of privileges, when for example a first request is made with Admin permissions, and the second request with different API Key is made with Viewer permissions, the second request will get the cached permissions from the previous Admin, essentially accessing higher privilege than it should. The vulnerability is only impacting Grafana Enterprise when the fine-grained access control beta feature is enabled and there are more than one API Keys in one organization with different roles assigned. All installations after Grafana Enterprise v8.1.0-beta1 should be upgraded ...
A SQL injection issue was discovered in QuerySet.explain() in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. This occurs by passing a crafted dictionary (with dictionary expansion) as the **options argument, and placing the injection payload in an option name.
Nokogiri is an open source XML and HTML library for Ruby. Nokogiri `< v1.13.4` contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri `>= 1.13.4`. There are no known workarounds for this issue.
Elide is a Java library that lets you stand up a GraphQL/JSON-API web service with minimal effort. When leveraging the following together: Elide Aggregation Data Store for Analytic Queries, Parameterized Columns (A column that requires a client provided parameter), and a parameterized column of type TEXT. There is the potential for a hacker to provide a carefully crafted query that would bypass server side authorization filters through SQL injection. A recent patch to Elide 6.1.2 allowed the '-' character to be included in parameterized TEXT columns. This character can be interpreted as SQL comments ('--') and allow the attacker to remove the WHERE clause from the generated query and bypass authorization filters. A fix is provided in Elide 6.1.4. The vulnerability only exists for parameterized columns of type TEXT and only for analytic queries (CRUD is not impacted). Workarounds include leveraging a different type of parameterized column (TIME, MONEY, etc) or not leveraging parameteriz...
GoCD is an open source a continuous delivery server. The bundled gocd-ldap-authentication-plugin included with the GoCD Server fails to correctly escape special characters when using the username to construct LDAP queries. While this does not directly allow arbitrary LDAP data exfiltration, it can allow an existing LDAP-authenticated GoCD user with malicious intent to construct and execute malicious queries, allowing them to deduce facts about other users or entries within the LDAP database (e.g alternate fields, usernames, hashed passwords etc) through brute force mechanisms. This only affects users who have a working LDAP authorization configuration enabled on their GoCD server, and only is exploitable by users authenticating using such an LDAP configuration. This issue has been fixed in GoCD 22.1.0, which is bundled with gocd-ldap-authentication-plugin v2.2.0-144.
PrivateBin is minimalist, open source online pastebin clone where the server has zero knowledge of pasted data. In PrivateBin < v1.4.0 a cross-site scripting (XSS) vulnerability was found. The vulnerability is present in all versions from v0.21 of the project, which was at the time still called ZeroBin. The issue is caused by the fact that SVGs can contain JavaScript. This can allow an attacker to execute code, if the user opens a paste with a specifically crafted SVG attachment, and interacts with the preview image and the instance isn't protected by an appropriate content security policy. Users are advised to either upgrade to version 1.4.0 or to ensure the content security policy of their instance is set correctly.
Garden is an automation platform for Kubernetes development and testing. In versions prior to 0.12.39 multiple endpoints did not require authentication. In some operating modes this allows for an attacker to gain access to the application erroneously. The configuration is leaked through the /api endpoint on the local server that is responsible for serving the Garden dashboard. At the moment, this server is accessible to 0.0.0.0 which makes it accessible to anyone on the same network (or anyone on the internet if they are on a public, static IP). This may lead to the ability to compromise credentials, secrets or environment variables. Users are advised to upgrade to version 0.12.39 as soon as possible. Users unable to upgrade should use a firewall blocking access to port 9777 from all untrusted network machines.
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. SQL Injection vulnerability in entities for applications generated with the option "reactive with Spring WebFlux" enabled and an SQL database using r2dbc. Applications created without "reactive with Spring WebFlux" and applications with NoSQL databases are not affected. Users who have generated a microservice Gateway using the affected version may be impacted as Gateways are reactive by default. Currently, SQL injection is possible in the findAllBy(Pageable pageable, Criteria criteria) method of an entity repository class generated in these applications as the where clause using Criteria for queries are not sanitized and user input is passed on as it is by the criteria. This issue has been patched in v7.8.1. Users unable to upgrade should be careful when combining criterias and conditions as the root of the issue lies in the `EntityManager.java` class when cre...