安全研究
CVE-2024-23724 Ghost CMS SVG 存储型 XSS：从头像上传到 Owner 权限接管
Thinking
2024-03-22
2 分钟阅读
研究档案
#漏洞分析#代码审计#Web安全
Ghost CMS 允许用户上传 SVG 作为头像但没有 sanitize，攻击者用含 JS 的 SVG 偷 Owner 的会话，触发 XSS 后能把自己提权为 Admin 再升 Owner。
Unlock to view this content.
ad8d9422966c73fee42096dad808c6448a272095349f41facc28f3d18d1ee66a0726fb5aaffd9271b6702e0ae53f6961031443030e63d37842b7356b4a67d1f44b648f709f84d99b1640e6f7a87a3d44129b61502fc0c5c728a88c67798e6cfb7bcb30fe880464fad1a2cf9635735fbd6e964b402ea4ed27e494f7c87c72f1c586b333a47062292625ea7240d146fb061f3975a6253d117e97272d7df5aa897fb9fe2c09034f658aae2645a68076992d7d9de07ae63e2fac88f85e475412988dfbc9237687cc8d286c0cc05eab1afba0050d6795002cafc0765c92e3bc37b09cf99e023d3202c8070e44aa14f4d0e7a35c02e237795c862e9e881e46ad3eaf9e916188590e203f80b35e01707a69b31f0b86dedba8868fda2cc972bbbb33c80e0627d10cce0c369e38b5595e29219d8f9fd0294d2d96ec95d3f975d4d6130e44eceb6c7e3a4b2794269bb6825ded668fc78d6420bf373301509789544caa2ba8ac9b45d5b7007ec21586497f8bf13a68624341b8487989e5eb68ff8acc9cff740264f8aabe7bd4574bf003911b1239a0e42770e326a61526565e90eb76df2a4cc0c225ccd01d36f07c75912d8e02b0188cbcc54d24cc61ae2af7a3addbb67f13131e097a639e951872d2c0ff0c082a092c8c1428624e31bed1397b9718473ba7d1bd977e10df910b345dac05642980c6a61a534877d8d8ae0f6daf005198b5cc34dd0a4aadd6da2b571be8715f702e446e3a7772b6cde6425eba3886e0fb55630c2b3938a88df6ee56867bb65e68cecf5d4796266e984b7330d7f64452f2caf6640c6e0da6cb8698eed8e5518761db492858ce03b8e0342d24bae996a2b98444636dc72a1a958ebb2b97414c70f30fe3723f0db41d56c03b380897cb929fd905182ac71fba68c0ba509f9f1b994ebb5189c9fd56833b3672a1b8ace12ca8f7fc604965e4775cc6072e34f6171e5c53bdaa00f0602a7f33444939793e55ef5c468dffd7617c3ab4d36ba15c75436d847e7036973afa16a1d2b2ffc773242101866b6986b2cfa70b84808eda16f0cac91e6a8c1f2bdda9132394f3380505ac837e6403cfe9e2ec9ded0b144c4cd7b643734b534c2a240940de81601b12f90706b2f0e5baf46aeb1d2408409f01ab1a1d252d77832fd668d2ef06b19f385ca839f8d1cbda151b399db07ecb734f448266d1d401e18757135c3e981101616ba480df5a172a5a069f510a23530a344cab82f38f4d74101ad629349fc69318c4987e768f99c76a8dfbac2f0eaf431dfd6e3f32fc3811dc65f287a1e2afe55215dffb987720e8fd1a7acc938e166a7a45b6cee7683ee7de46586ca9649638bbf1a7f42387ed762b058423134cdef15b1ceec3984d6d2fad9135323139a9ea01c08b62be554c7a291694014a008ac73b31485ce58f251386e1ffbeac46ccd77221dda4a531190aca5718140a375860242862071e4d7d0602dd7b1676876b94b08903e55bac9da238d4f34ac3080da9e2e0144633e6f4bb0e89c05a6236dcabc5806dac436e6d265242282e99e1055dc060e2602169111d94f5fc025710c0c852af3fd56df8608e5b54296796b3d166c55e5e45f4f5a1fe042a992e4937b8a5c94180099412c69b25ebfe80d87dc51724fa9634e18fd5f887fdd04ea07e5e78fd78d7a22b56fce57f65097e3067de95d5617893484dfbab7d0ba6f0ee01bb21bd3f2af5f00837962e74328f321c72b748329e9d6922f76339493758a4d13152da7f9a4e25f8936e4fbcae1cf925e782b4a777ddd9b83c59043239c2d139ed331fa3c39b998cbb1f0cc286162abe2d2716e3f6ee7d8dc1ab2489f930abfe54ab25acf746935d805029cf86bb56cea0e95e13d7db71bbe2ebee01a858d88c7563e150a436379ebf1d41b91d1ceaa4684d8b57f776cd9b1ae01d30e652e3d1fc0d55b9f58d9486fda025c1c226d122e62fa14f0bc0fdc80211151c7f680e2725b9545275acd93f5855a70ccad7e3aca996107a339139c9d9f432943311a44d041f093cce2ec15effc36be760c6931a8e0644e815e691a3ac51093fdb5896d68bf6eaba85444acfa3837ec6dcdcfd842d7e7cb260433327d14c16adfa30c67b3bdfcbc1fe17e44c1e41914700dba0485b1514c1f82a8b7d1614456e7f858b1bec1931b8c7447b1a98559bd89566f29e179047e228c16a33269e3066e2d19cea58c09f591412e1abd1acad8765cd76892447889f1979c14274a57484ae93737c4f60a807440c0c7b7286b4993f1e4e2f0222456d9fc84100641c8f87dd3b9b34394b389e0a3eb1ce5d2ca16f39a6c17cd0938bd249387f2faa421fde4251fbea73705e070e5baf2b0a74d547db1cb6a25aef754500968909c92533ecc281c2ba0ae9b99df311f60821b083c1cd0acdaeb05d8c08e4daeedc083f89ebcdbda0f9c2897481002a613e39a05beb2b4d47725d821e5244c95b20809908dfadab20a8378e629e401a6279b0868bb34f5928c05daa3e0b90e58ed2b9a56139adf2b0ab7c763be20092e91b3e50bb1fa8b672af0f847be7a1b02eaf7789fa2918f6b7e8474ebba7134e71b030b8833c3939612664ebc9b46ebda5e39bce0cfcb0a646a46ddccce439dae4b24c7b88c28dadc743611c1405986b018f1cba4c6a419c0cb9638088f449f70361f4ca96171c28f02285d78adb29d775bb22306eca631e404eb607ca676810a59ff40beb4e0d3fee50245078f7b30d6a9b3e3d932f176ad4a78fa6d8334799499c65b627c8d7c255fd1987294e281ebf40a09cb32684fc1e77c4ceaa6357ffee25c381d2c84b4e1fa248159c955791975f692e34b2bba69638a7f82f3f91b5269e9d1458fd887091101eb2b3a8554598d894adf2ed00916e3e0b6b117ef1c963a522b04eff1210e5628af075d885948e63ffc4200ec2e57d3ec98aa9a0708c020e43e176ffeaaa0646134809a3ed20867c6a8b2ead73e23fc9b5de9de143cfff603cb66f71e0b7695a44da086850973f61c0e3fc9e5ec6a213d136f42e1cfba3f1222c58503263ed915796ee8375a5da37989cbcb97d08e187ddd2564fe133ba8f02a156cc74d7990c4d953491b00090c5b346956c01a263eee05f8977edcb3505679807d21ad382519416f002abcd0d1dd1551e61edcc34b40253d7ebf16852e4522b8d74877d24269fef4b809e9932c27176cfd6070988e5d583aed2284f623ae4995867e16043be218c548e03ec51196164d5f11965e216cf60515f724a5c4b040cfdf69a4a3938f68b098567b5048b30fd5b53930a335132e5afea99a909cdb8e2514d0a8cda2110c224fa553b1efc3cad1c9ad7657fe3ce4f4316f530d31098382b45c46d556a2e6362013abce96e4533d9db5de237dca2afc22f9a288d03a78cf4cf5752116ed5efa2a9c74b6940e1f10d73f5cb2289a2edef143d22fe3f1f709e75a0f9ca6d9c816e391dd55a8ffd4ceb4fdc3d4a7450be61f730422b5fd9eb6d269e3d3d0c4bd50415561a6d8e53c072924f6549e151a32b1e1fe3d452c80300095fd3acd9df8335e4bc2f78d295665cf0d8d413f5bec792d4a9ce7e0d28d3dec77235d1dd3f411f494f3b2a59ef92bbbf3e28ef770c84a5e955ef113833dd30eab6984f959f8dd8847d185a0437b009f9068dfe47ebd49c3d875d06e2855b00d7d8df7e65f212e68face469fd0756e713892bd063bb2829c2713c83fafffd3d732dc427d4c1c38865f0085970e7e498f675abd81380329b94d3c81c9d756d3425390bc9f9cf394e5d41899db6dd693240db23bcc26a697fa73ab43a2e17f1ec539c5752d33565050026c1411795395dadb217252c2e06777d4430833161a86dade6869df8c67451cacf2e43ff97686734dff0e3854fcfe0a672bdac87989b7d955fab0e30869049382827b3ab2950beee658e8a9eb3897ebb1e1c381742aee5219340f6f5af2f055e8ca885dfe457cacb304d38ed39ec552342a04819f3c4111efa4c076a31ef58887d59f9c3b0323bada7ad706c1fcbf3b9bb0e49ecbf2c30c8e05b18caf95dd3c7e1d5c7641d813150554ab60c34983f013c74157caa39e2268b2e98d61fa4064da4c7c6f6297d852685232596f1c753bc4801b198c54f2794a993b8ae0fc0cda111f0d3929112e75bc1d8c804cf5e6db65b801529d38f24982adc0d0025923b24185d38994dc9d4ec575f7bcc5c5b2e4f0477579d99b7ebbb2ced2cca7573560ad17edcded9787b48a3965f8fc0e86b7d94a4c2cf1cbd6f250afcbb64dc042896b818ce295ddb929c1aab5b1afd4473e59193e163265b1bd3cde559135ae5a009e2985187e1d92e8d7e0b6756adcfaabbcb92031152b53971b45a45c20b240d89424451988612006f6146211b5321bfa416a59099b634ef8b7ccd2ea4f2066b0501f8c0235e5a70d3a9eb46ba2b09d756e94a511c98ff866afd42dca5e634df5907dc172c58b36e285b2964e4a9d2f9af3f062ef75e3b1f43190cce3e6508b437cea453032bdf82a03109c194367f9477e86e4adac9662bc9f6707f6d4b0154296e8a1798ae7b71aa36972b095875c12bedda312a07b72110a4ff993ede7ee3c0b2768573c6324a4c49d48d7c89904927c8b6adbb3b28bde7aa0b8fa0b6c3d128caf5615bea515183ce04465d964c4e2b877b9bf9e2f1fbeba354438a5159ec41ebbe8fda1294c9e9c9f352b5e43c6dbe365daf2f8277c72a6c651f188d6273061c71526302ad6469191f498f2edcd5077b2e2d73624da038c1144f0397a97e753162cbf5fd450d81b2a47757362d58f429dc1b334aaa78daadec25ff8b4a523c029cca88e46c0919fd0ca3e581776bf2501844b97f5526a4a942789bde22c301a63ad78ea43c7cfceb0c1494f7de7eb67d33adbb54d64a9c45fa32d0fac34921711493e567f20062048c117971cdef4ed4e285641e1e7b0fdfcedb695d3f175c53aad0dc18f9f6a7829ff0c5873061e08e976294e4bf23ce8534376f524cf3e32955e95b6054b7a7c3bbb988ad002d10c4af67d0ceaf434d6a93e0707b2ca5c4aa57b0074b6dc1eb04ac8d42b1765fa9a07dcf5b6e306867c6aa24da3746c863a122ba9fddc42252a78e8e389583c9d7bed1ebc0fdb5eee15278797079fd4d9d9ddf292d706719e52bed8215579f745e116931a24fed6ac2d98bc16ade02d4ed258a6cc910aff21ada80aeaec59a0c8b57179805d94bf0ed49e998bb48534ea6f706311ad33ac68a94c3560eb8e63b613beab960d52c37afe577005330c40a82607f162a82f5643688b2eff5134e840f90fb0cc558ee8536f01eb46c9cfddd7440f8026adbf318bc7fe1b595fed00d4a9bae7af4fb0559c3719cfadd2d0a8e8f677e25918168e2ca3a454d5275456a7f393106a2d38287bd21eaf54c0ba4495e692edec8cd0fc9b365aecb7a73dab033e38df50b44ddcf5d4d6fbdc0c4f6c28ca1f759dda596691d5cc53cb299f4ff0c638a6199ce50894e46d24aed0cba157040ae38f87765302d5f5ead462e7bb5db7365edb876dff9a6e1a7b0047f1e5a1eb891d75f995576cf7ec1caf8e19752a6420a927935673d41327f24499a2d28f9b5f4eefb84db74551d3e79ca2656f32e748d9506d42362129907202831c1239dcb67173a2f394f96bb4510bb8519b3e44cfe592d4afb91d53460735a5b514e1df5dc1cd3daf9daba853e899ec942cd5b266d383bd7f3c275d3afb1b3c8fc847aec0e9a8910660ae741cea0b2d01ad0f861bcd9eff6472c1af015e8a537aeef1def45286d95397fd637d3f273e201632c132aa2534af597e0c743c98f235cb3b3e9703e1138f2a47a9ee5098425b6404ae5b59a34e0bccf39661b47d41fbc943f70efd39471ed1f56addc8bf75b01dc03468755d77df23cf5b5d18adc2c47d4d6cc88965e2604c1b1e4c2c8f712a3ae4c8cde1ffe36d6f80687b98494db91cd29a15c953937d589caeeffacd663cd04a62e28330ba16411b922ad74d8d78769756e620f67a074f09eaccc730218b419a1d66747345eccbe72a8eef9d966ec2d3058681bc986e88e7572653363dae1c1a0eb1da073e22501b02bc96b0521b704ce1823d6b3d89c5fe7ed628668438d1009706f2e4bbef4c45ac4e104b7953cb8eb112d4de84ddba9b22d1e258907061cc9fc6c46247c6206dff40ee6b149daa7c4d77a475e810dd2ea84c5612dc6a29e9c05b91c323797a09973a20ab1373696ebb740afdd745960be2e3f387446bed12cf2d6bd2a58b83f909807eb0bd12d153015d55fe592e6e58acca8d040fb9c5ce5d1d94fa3826edd9ee5a081295928e4558298ecaafede5f99171e48250e75e54878495fa0b04cc6f4483756f5a5b22d2e28fb8a6fa915ea6c20060604c1500e9fc07d55b6e21e3a330236da7f908809bb56e2176a439dd33c234497e0c96ed5c690da0cb6310ce9f4565bd3f9328c9a072b1e4fd78376e0ae8b0df1c8175c2aa7fbc9c6f026620282725915258c113a1f19b961a5d0c5ec475c7089f5cacab36f8f588d9f4106c8c504fba3e8d214ba1215df6b4abc862dc7eb30165a9aae7e6a4188cf3d351a44922bcf4015cc778a5349bf29467380419070a8260a94883db807b11d8442767b1a16fca7f5af18676620918aa601992cf8c4bc0a674e43cf12870dcada31df9bbd8920c3991bd952a848f186cbe73b84cfd441eebc793ec49522daf3722dc4a0ada884f415f49f0658ff767441078dedaeb781028a88121a08922431f7e9d338abac34bb2b608ffdc984c5f9304920c0ccebd17046738deea2a5f1f5b3336567eb1990a3bbce4eb723426f6cc401f14511bb872537ac16eb61aa6e6157c7c8fd8dfd00fed729472e776aef916abcf1697ae82f8bec9478cfe01e5242a93b270967dd8dc493394ed8ea2bac0d4f3acd19430e1cb40203fa8fbf42f26a9cb666a0fd4e55925ae65942aedf395c78bcb86caad1510c5a2d4a03a5a467dd070d59c0226a946905d61f78ac7bf480f252d39cd065c3bdfd3297986b20adb2d8b627f55e99ba4ff0545a1e88717caea44ecfa92f98a0bf33733cade4d19e62a27dd6cd243473a547ef3d7eb8868e4db14527dfa4f79a93103c664160534b32776c235db8491587e43bede57683ce7b65559345321fbc70c25e25a87d45f733f1c98aef992ae29d3e27d1780216d0f9039dee86ead264b3b2c9631e23625d64ab72ab3a1f8b959a3bdff2b8bfa2ad07c7c6a2f9fb0177a77218ea6cad66d2b3dd99667c6eed1c71a5b48e674c323a7528652d382e7d60138dcd099c36f49812c2900b1337cd6f31510500757190a59922bae5742a2a3e52ba37dd70515d885dc4794a96fd678cf110a5255683d62f55bc7eddf8dd5c14fe9422ea54446ff810718258983bb35ce0a0fd450c732102c6998be1cae7d18f0d7c457f08b46acc652bc352dd2c2213b360a4d24bd03582a09112bf37a17805850f93f5ab10e2bb171042845190253329826cefba21d19e31675fe3ff857be70fcfd1d8e73c5bc551e43ed901ea55ee6dcb4ea15b94c19adc80f52814b3e25cd10746e14bdb2914d49f3d8f73819ff01244b9a4b1bf96c0255c5ffcc0c8326e43beb02b11d152e5e93ea9954ef69f5eda51b89eafe70679db3308fbcba5a75085c71972c584b766da0795c7a5b39f7d7e7baa6429c1c265565fe7b3bebb98e15517eb669ca4ffe64f0a4b72975a25ad84132ddcd74b852a2fc4735cb05ff1a929d44cb892719b2c30e16b9319774f6d05ab43f0f82b0bce6fb312024a58e5b3ef1b3078dae64f18ad43142a7d8f09f9c9bc5c7823f5ec9090d95ed299df49095e873c81a5d7597da52c80ee5bd873562364450857f7e939e4f3d0a8409e816b24ccae0226949fe1db88246f5b5e895ead21b6f6c6b55b5ae36b25f4f7b7e2f78e3313cf38e0d3ce81d3240bcdafa5b7906d1db67fa345fd7b08dd1f70ee4a630d6e05e08665c22878cb9c2a703c679b940c93542ba81031e8fc66675947925608ae8d1de6b2f9a9e9416e2e8de2a2def8fae6d1e74e2d5d2a578edc8eb300a17907c37192c0031e72c80191e7b60f4b4b4af3e32cb276a5a4f8c919234f3423ac4966dd89550ea6f296a5706e151cb696fd27d2b4cc9a216629371569be97697d8563a5f81cba76152da5a2ff3296ad28fc58ad1b8356b2ff463a7838c340480d16c00f8022fbf7ff686247df026ee277b298105bb1ab4d6fcbbfc5b41199e3679305a869be87d6d430394cfffab4536270e9460c6433b7cae1f032590fd11ef7dec11cce4c5e7527531c4b0dc9b046ba8959a8ecb041e6bee30dbe302c6604104bfc3896ad7edb6667ca21cfaf2bf908d73ab7a5804bc36a90e8de5389328486c1c3f22ac0020b9239e579dcd6cf8802f27256c49f22e8bf01d9360061a0eee6d3311edb6035a9aba959833b3f9c303deab7ccfb9e28a32aa273f6651d5c9f5abf1e3a1c7ef04d6631e869119a256782cb93e3c820f9b6035b5bcd026ce2bf3c66f76e9c69c4c331f305d9a9aa5ebbe0ba02afcdc5ff8c3ae80e78cc45c278d18c2a6f865a506294f80df27c9fa724aa75c4a752ec7fc9570588b9732d6cd41bfd8f46a1c0d10d348cc5cad9fed12ca3354a6c7041ee0fcc8f1ced1eeeeeaca2b216dd830df44ac73d9df901d8231c5144da5862a35766f101f2369bbe04deb3228284968c7c25b2a0a3e484309b06ac63f8e0fe0c798d1aa7848e7391ed53acf637afdd10647deb3fb382a720a2a9bbb53d0ad6e64a8e0438cb5d7c8f75df2c1b6c4d549d8e8606c042474a27586159d0d5bff0ac340295ea3e3c7ea8bd0b79de6fac7573178fc7da6def32fd4272f89bf635b0753d9da83e4d3053cdde991168648188acdee5bc4c3f2e325aad4751f727025028d8a27b2a1066a3bbf37df1255f130546edbbd6646820b90b27d362e17de617357d7419126fc852dbd4994f4fec3bd0bdfd857c48f209126c919314673c1323d6ebeeba8184d2fb62a3e8482c2d6a28599d57bd52d09d9f91bfe041a3759debdfe149380b62cf1bb62f13224fcb5350611d8ead6d3825946ff8db366bf7efcad45bc7a68faececb423612c5fbc163e81330bfcca8a4b2e25e2dff8f3130c234a20e588bf8c08a8a1b04fb8676c162d938eb0be87e172b6b8155d7b6e03adf7e811490032314ad04c3825abba7a356bc84a10e6c196d81833aede5fc33ba3db6fdf643f9bfc19386d9f927478fe3c3ecd78c6f8adaeeefce5c35374a3910bcb24103f29489cd593e292caf9fc04913660530de1a61bc486ff0c533ae1d569285e0ec092102e1c4690de451a75c19fdd99694a24e6d46b1356bc34f9642e77132cbf8644fe871cdf8e5a74bbb7f25448b2637c4e2ddf353bc38514fc38daaf41a96f94b42c37bf0923d0dba837cea2766a35820aaf77e7655f33d785e0141de65f826435210be5cab0418dfe43ed3bb63306add58fc43c4cc0066f3b565be461325d8f813d37bc63b063fb0a2b46f8b14d27454087841d8f71fae570a95c841a9d61b94fd52fe5366c05b3a959223c56f841656450e0b2b29d0c0e2977054f19ac61b9d8080de43c1a0af7bec9f7bb456