CVE-2022-47194: 
NixOS vulnerability analysis and mitigation

A stored XSS vulnerability (CVE-2022-47194) was discovered in Ghost Foundation Ghost 5.9.4, specifically in the Post Creation functionality. The vulnerability exists in the 'twitter' field for user profiles and is part of a broader set of XSS vulnerabilities that affect default installations of Ghost CMS. The issue was discovered by Dave McDaniel of Cisco Talos and disclosed in January 2023 (Talos Report).

The vulnerability is classified as an insecure default variable initialization (CWE-453) with a CVSSv3 score of 9.0 (CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). Ghost CMS separates users into different privilege levels (Contributor, Author, Editor, and Administrator), with Contributors having the least privileges. The vulnerability allows non-administrator users to inject arbitrary JavaScript in posts through the twitter field, which can be exploited when a higher-level user previews or visits any post by the malicious user (Talos Report).

The vulnerability can lead to privilege escalation, allowing an attacker to gain administrator privileges through XSS exploitation. In default installations of Ghost CMS, this effectively means that users who can author pages have the same privileges as administrator users. The vulnerability can be triggered when a higher-level user simply previews or visits any post by the malicious user (Talos Report).

The vulnerability requires an authenticated user with basic posting privileges to exploit. The attacker needs to inject malicious JavaScript code into the twitter field of their user profile. For successful exploitation, a target user with higher access levels must access affected resources while logged in to trigger the injected JavaScript (Talos Report).

The primary mitigation is to separate the admin domain as documented at ghost.org/docs/config/#admin-url. This configuration prevents the vulnerability from being exploited to perform privileged API calls, such as modifying user groups or adding users. The vulnerability was fixed in subsequent versions of Ghost CMS (Talos Report).

Initially, the Ghost vendor team did not consider this issue a security problem, as documented in the timeline of the Talos report. Despite multiple communications between October 2022 and January 2023, the vendor maintained their position that this was not a valid security issue (Talos Report).