Executive brief
Strapi is a popular open-source headless CMS used to manage and deliver content to web and mobile applications. A stored cross-site scripting (XSS) vulnerability in the WYSIWYG editor's preview feature allows authenticated users to inject malicious scripts that persist in the database and execute in the browsers of other users viewing the content, potentially leading to unauthorized data access or account compromise.
Technical details
This is a stored XSS vulnerability (CWE-79) in the WYSIWYG editor's preview functionality of Strapi versions prior to 3.2.5. The vulnerability exists in the strapi-plugin-content-manager package, where user input is not properly sanitized before being displayed in the preview feature. An authenticated user can inject malicious JavaScript code through the editor, which is then stored in the database and executed in the browsers of other users who view the affected content. The attack requires a valid user account (login required) and user interaction to view the preview. The vulnerability was patched in version 3.2.5 via a security fix to properly sanitize preview output.
Affected products
- Strapi strapi-plugin-content-manager before 3.2.5
Timeline
- 2020-10-29: disclosed
- 2020-10-22: patched: Fix merged in PR #8440