Executive brief
Strapi, a popular headless CMS platform used to manage content and APIs, contained an exposed /proxy endpoint that lacked proper authorization checks. An attacker could access this endpoint to proxy arbitrary requests through the Strapi server, potentially bypassing access controls and accessing restricted resources or systems. This vulnerability affects all versions of Strapi prior to 3.2.5.
Technical details
The vulnerability is an authorization bypass (CWE-862) in the /proxy endpoint of Strapi's admin interface (admin/src/containers/InputModalStepperProvider/index.js). The endpoint accepts a ?url= parameter that allows proxying HTTP requests but did not properly validate authentication or authorization. An attacker can make network requests to the /proxy endpoint without authentication to relay requests to arbitrary URLs, potentially accessing internal systems or exfiltrating data. The vulnerability was fixed in version 3.2.5 by removing the insecure proxy functionality.
Affected products
- Strapi Strapi before 3.2.5
Timeline
- 2020-10-22: disclosed
- 2020-10-22: patched: Fixed in version 3.2.5
- 2021-05-10: advisory