Executive brief
Strapi is a popular headless CMS framework used to build content management systems. Versions before 3.0.0-beta.17.8 contain a command injection vulnerability in the plugin installation feature that allows authenticated administrators to execute arbitrary commands on the server. An attacker with admin privileges could use this to compromise the server, steal data, or deploy malware.
Technical details
The vulnerability is a command injection flaw (CWE-77) in the /admin/plugins/install/ route of Strapi. The application fails to properly sanitize plugin names passed to this endpoint, allowing an authenticated attacker with admin privileges to inject arbitrary shell commands. The vulnerability requires network access to the admin interface and valid admin credentials. Successful exploitation allows remote code execution with server privileges. The fix was implemented in version 3.0.0-beta.17.8 via input validation on plugin names.
Affected products
- Strapi Strapi before 3.0.0-beta.17.8
Timeline
- 2020-09-04: disclosed
- 2019-12-01: patched: Fix merged in PR #4636 on 2019-12-01; patched in version 3.0.0-beta.17.8