Executive brief
Strapi is an open-source headless CMS platform used to manage and deliver content to applications. This vulnerability allows an unauthenticated attacker to reset an administrator's password without possessing a valid reset token, enabling complete takeover of the system. An attacker could gain full administrative access and compromise all content, user data, and system configurations.
Technical details
The password reset endpoint in Strapi versions prior to 3.0.0-beta.17.5 fails to properly validate password reset tokens, allowing an unauthenticated attacker to reset admin account credentials without providing a valid token. This is an authentication bypass vulnerability (CWE-640) affecting the password recovery mechanism. The vulnerability is network-reachable and requires no authentication or user interaction. An attacker can directly craft requests to the reset password route to overwrite administrator passwords, achieving privilege escalation and complete system compromise. The fix was released in version 3.0.0-beta.17.5 and later.
Affected products
- Strapi Strapi < 3.0.0-beta.17.5
Timeline
- 2019-11-07: disclosed
- 2019-11-04: patched: Fix merged in PR #4443
- 2019-12-02: advisory