Executive brief
Strapi is a popular open-source headless CMS used to manage website and application content. The vulnerability allows insufficiently privileged users to access administrative content-type configuration features without proper authorization checks. An attacker with limited admin panel access could modify content schemas and structures, potentially disrupting operations or exposing data.
Technical details
The vulnerability is an improper authorization issue (CWE-276/CWE-285) in the content-type-builder plugin component of Strapi. The CTB routes lacked the admin::hasPermissions middleware restriction, allowing users to make modifications to content types that should require elevated permissions. The attack requires network access to the Strapi admin panel and some form of authenticated access (even with limited permissions). An attacker can exploit this to read or modify content type definitions and structures. The vulnerability was fixed in Strapi 3.2.5 by adding proper permission middleware to the affected routes (GitHub PR #8439, merged October 22, 2020).
Affected products
- Strapi strapi-plugin-content-type-builder before 3.2.5
Timeline
- 2020-10-23: disclosed
- 2020-10-22: patched: Fix merged in GitHub PR #8439