Is CVE-2019-18818 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2019-18818 being exploited in the wild.

How severe is CVE-2019-18818?

Low severity, with a CVSS score of 3.1, published 2 December 2019.

Which products and versions are affected?

strapi (npm) SEMVER:introduced=0,fixed=3.0.0-beta.17.5.

Is there a fix for CVE-2019-18818?

Yes. strapi (npm): upgrade to 3.0.0-beta.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2019-18818 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2019-18818?

Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2019-18818: Strapi password reset authentication bypass

CVE-2019-18818 · Severity: low · CVSS 3.1 · Published 2019-12-02

Strapi is an open-source headless CMS platform used to manage and deliver content to applications. This vulnerability allows an unauthenticated attacker to reset an administrator's password without possessing a valid reset token, enabling complete takeover of the system. An attacker could gain full administrative access and compromise all content, user data, and system configurations.

Technologies: strapi (npm). Vendors: npm.

Quick answers

Is CVE-2019-18818 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2019-18818 being exploited in the wild.
How severe is CVE-2019-18818?: Low severity, with a CVSS score of 3.1, published 2 December 2019.
Which products and versions are affected?: strapi (npm) SEMVER:introduced=0,fixed=3.0.0-beta.17.5.
Is there a fix for CVE-2019-18818?: Yes. strapi (npm): upgrade to 3.0.0-beta.17.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2019-18818 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2019-18818?: Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

strapi (npm): upgrade to 3.0.0-beta.17.5 or later
```
npm install strapi@3.0.0-beta.17.5
```

Technical details

The password reset endpoint in Strapi versions prior to 3.0.0-beta.17.5 fails to properly validate password reset tokens, allowing an unauthenticated attacker to reset admin account credentials without providing a valid token. This is an authentication bypass vulnerability (CWE-640) affecting the password recovery mechanism. The vulnerability is network-reachable and requires no authentication or user interaction. An attacker can directly craft requests to the reset password route to overwrite administrator passwords, achieving privilege escalation and complete system compromise. The fix was released in version 3.0.0-beta.17.5 and later.

Affected products

Strapi Strapi < 3.0.0-beta.17.5

Identifiers

CVE-2019-18818
GHSA-6xc2-mj39-q599

Timeline

2019-11-07: disclosed
2019-11-04: patched: Fix merged in PR #4443
2019-12-02: advisory

References

https://github.com/strapi/strapi/pull/4443

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.