CVE-2024-34451: Ghost Authentication Bypass Vulnerability

CVE-2024-34451 Overview

CVE-2024-34451 is an authentication bypass vulnerability affecting Ghost CMS through version 5.85.1. The vulnerability allows remote attackers to bypass the authentication rate-limit protection mechanism by manipulating X-Forwarded-For HTTP headers with different values. This enables attackers to conduct brute-force attacks against authentication endpoints without triggering rate-limiting controls that would normally block repeated login attempts from the same source.

Critical Impact

Attackers can bypass rate-limiting protections to perform unlimited authentication attempts, potentially leading to credential compromise and unauthorized access to Ghost CMS administrative interfaces.

Affected Products

• Ghost CMS versions through 5.85.1
• Ghost for Node.js deployments without properly configured reverse proxy
• Installations exposing Ghost directly to the internet without trusted header filtering

Discovery Timeline

• 2024-06-16 - CVE-2024-34451 published to NVD
• 2025-06-20 - Last updated in NVD database

Technical Details for CVE-2024-34451

Vulnerability Analysis

This vulnerability falls under CWE-1390 (Weak Authentication), where the authentication rate-limiting mechanism can be circumvented through header manipulation. The core issue stems from how Ghost CMS processes client IP addresses for rate-limiting decisions when multiple X-Forwarded-For headers are present in a single request.

When Ghost is deployed without a properly configured reverse proxy, the application trusts all X-Forwarded-For header values without validation. An attacker can exploit this by including numerous X-Forwarded-For headers with different IP addresses in their authentication requests. Each unique IP address is treated as a separate client, effectively resetting the rate-limit counter for each request.

This allows an attacker to conduct credential stuffing or brute-force attacks at scale without being blocked by the rate-limiting protection. The attack can be executed remotely over the network without any prior authentication or user interaction, making it particularly dangerous for internet-facing Ghost installations.

Root Cause

The root cause of this vulnerability is the improper handling of the X-Forwarded-For HTTP header chain when determining client identity for rate-limiting purposes. Ghost's rate-limiting implementation trusts the X-Forwarded-For header values without validating that they originate from a trusted proxy. In environments where Ghost is exposed directly to the internet or behind an improperly configured reverse proxy, attackers can inject arbitrary X-Forwarded-For headers that the application accepts as legitimate client identifiers.

The vendor notes that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers, indicating that the secure configuration requires proper infrastructure setup that may not be present in all deployments.

Attack Vector

The attack is executed remotely over the network. An attacker crafts HTTP requests to Ghost's authentication endpoints (such as /ghost/api/admin/session) with multiple X-Forwarded-For headers, each containing a different IP address. By rotating through a large pool of spoofed IP addresses, the attacker can submit thousands of authentication attempts without triggering the rate-limit threshold.

The attack requires no privileges or user interaction, and can target any Ghost installation that is directly accessible or sits behind a reverse proxy that does not sanitize the X-Forwarded-For header chain. This makes it an attractive vector for automated credential attacks against Ghost-powered websites.

Detection Methods for CVE-2024-34451

Indicators of Compromise

• Unusually high volume of authentication attempts against /ghost/api/admin/session or similar endpoints
• HTTP requests containing multiple X-Forwarded-For headers with varying IP addresses
• Failed login attempts that appear to originate from numerous distinct IP addresses in rapid succession
• Authentication log entries showing geographically improbable IP address patterns

Detection Strategies

• Monitor web server and application logs for requests containing multiple X-Forwarded-For headers
• Implement anomaly detection rules to identify authentication request spikes that bypass normal rate-limiting
• Configure Web Application Firewalls (WAF) to alert on requests with excessive or malformed X-Forwarded-For header chains
• Review Ghost admin access logs for patterns indicative of brute-force or credential stuffing attacks

Monitoring Recommendations

• Enable detailed HTTP header logging on reverse proxies and load balancers
• Set up alerting for authentication failures that exceed baseline thresholds regardless of source IP
• Monitor for successful logins following periods of high authentication activity
• Implement SIEM correlation rules to detect header spoofing attack patterns

How to Mitigate CVE-2024-34451

Immediate Actions Required

• Deploy Ghost behind a properly configured reverse proxy (such as Nginx, Apache, or Cloudflare) that sanitizes X-Forwarded-For headers
• Configure the reverse proxy to only trust X-Forwarded-For headers from known upstream proxies
• Enable additional authentication controls such as multi-factor authentication for Ghost admin accounts
• Consider implementing IP allowlisting for administrative access if feasible

Patch Information

The vendor's position is that Ghost should be installed with a reverse proxy that allows only trusted X-Forwarded-For headers. Review the Ghost Proxying HTTPS FAQ for recommended deployment configurations. Check the GitHub Ghost Release Notes for any updates that may address this issue in newer versions.

Workarounds

• Configure your reverse proxy (e.g., Nginx) to overwrite the X-Forwarded-For header with the actual client IP rather than appending to existing headers
• Implement rate limiting at the reverse proxy or WAF layer based on the actual connection source IP
• Use the set_real_ip_from directive in Nginx to only trust specific upstream proxy IP addresses
• Deploy a WAF rule to block or sanitize requests containing multiple X-Forwarded-For headers

# Nginx configuration example - sanitize X-Forwarded-For headers
# Place in your Ghost server block configuration

# Only trust X-Forwarded-For from known proxy IPs
set_real_ip_from 10.0.0.0/8;
set_real_ip_from 172.16.0.0/12;
set_real_ip_from 192.168.0.0/16;
# Add your CDN/proxy IP ranges here

# Use the rightmost untrusted IP
real_ip_header X-Forwarded-For;
real_ip_recursive on;

# Override X-Forwarded-For with actual client IP
proxy_set_header X-Forwarded-For $remote_addr;