Authentication Bypass by Spoofing The advisory has been revoked - it doesn't affect any version of package ghost  (opens in a new tab)

This was deemed not a vulnerability.

ghost is a publishing platform

Affected versions of this package are vulnerable to Authentication Bypass by Spoofing through the misuse of multiple X-Forwarded-For headers with varying values. An attacker can circumvent the authentication rate-limiting controls by supplying numerous distinct header values. This is only exploitable if the Ghost installation is not behind a reverse proxy that filters untrusted X-Forwarded-For headers.

NOTE:

The vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers. It is not a vulnerability in the application itself but a misconfiguration on the proxy server.

1. Access the admin area prior to the authentication phase.

2. Send multiple login requests to a single staff user with invalid passwords.

3. Notice the blocking message returned in the HTTP response after five times, indicating the IP address has been blocked temporarily.

4. Add the “X-Forwarded-For” header to the request using Proxy tools and set it to a different value on each attempt.

5. Proceed with the Brute Force attack until a successful attempt has been made to guess the correct user’s password.

6. Obtain unauthorized access to the admin area.

• Disclosure Report
• Ghost Reverse Proxying Documentation
• GitHub Release