Executive brief
Strapi, a popular open-source content management system, contains a flaw in its administrative interface that allows users to change their account password without providing their current one. If an attacker gains temporary access to a user's active web session—for example, through an unattended computer or a separate session-theft vulnerability—they can permanently take over the account by setting a new password. This could lead to a total loss of access for the legitimate user and unauthorized control over the website's content.
Technical details
A weak password recovery/change mechanism exists in the Strapi admin panel through version 3.6.0. The application fails to require the 'current password' as a validation step during the password update process (CWE-640/CWE-620). An attacker who obtains a valid session token or physical access to an authenticated browser session can change the account password to a value of their choosing. This results in a full account takeover and persistent access, as the original user is locked out. The vulnerability is reachable via the network by any user with access to the admin panel.
Affected products
- Strapi Strapi <= 3.6.0
Timeline
- 2021-02-26: other: Vulnerability discovered
- 2021-03-08: disclosed: Reported to manufacturer
- 2021-04-22: patched: Fixed in version 3.6.0
- 2021-04-26: advisory: Public disclosure by SySS GmbH