Executive brief
A vulnerability in the Strapi headless content management system allows an administrative user to crash the application. By sending a specially crafted request through the admin console, an attacker can force the service to restart, leading to a denial of service. This disrupts the availability of the CMS for content editors and any connected applications.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in the strapi-admin package of Strapi. The flaw is located in the plugin installation/uninstallation controllers where insufficient validation of plugin names allows an authenticated user with administrative privileges to trigger an unhandled exception or resource exhaustion that results in the application restarting. The fix introduced a regular expression validator (PLUGIN_NAME_REGEX) to ensure plugin names conform to expected alphanumeric formats. This issue is resolved in version 3.0.0-beta.18.4.
Affected products
- Strapi strapi-admin <= 3.0.0-beta.18.3
Timeline
- 2020-02-04: advisory: NVD published CVE-2020-8123
- 2021-12-10: disclosed: GHSA-23fp-fmrv-f5px published