Executive brief
Strapi, a popular open-source headless CMS and API development platform, stores authentication credentials in a recoverable format within its documentation plugin. An attacker who intercepts an HTTP request can extract and base64-decode a cookie to obtain cleartext passwords, then leverage those credentials to access API documentation and conduct further attacks on the underlying APIs.
Technical details
This vulnerability exists in the DOCUMENTATION plugin component of Strapi, which improperly encodes (rather than properly hashing or encrypting) authentication cookies. The vulnerability affects Strapi versions before 3.6.9 and 4.x before 4.1.5. An attacker with network access to intercept HTTP traffic can capture the authentication cookie, base64-decode it to recover the plaintext password, and use it to authenticate to the API documentation endpoint. No authentication or special privileges are required to perform the interception; the attack vector is passive network observation (CWE-922: Insecure Storage of Sensitive Information). The fix, merged in PR #12246, changes the documentation auth cookie system to use proper cryptographic storage. Patches are available in versions 3.6.9, 4.1.5, and later.
Affected products
- Strapi Strapi before 3.6.9 and 4.x before 4.1.5
Timeline
- 2022-05-04: disclosed: Advisory published on GitHub and OSV
- 2022-02-08: patched: Fix merged in PR #12246 for releases/v3.6.9