Is CVE-2022-0764 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-0764 being exploited in the wild.

How severe is CVE-2022-0764?

Low severity, with a CVSS score of 3, published 27 February 2022.

Which products and versions are affected?

strapi (npm) SEMVER:introduced=0,fixed=4.1.0.

Is there a fix for CVE-2022-0764?

Yes. strapi (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-0764 attacked?

It is attacked with local access, in a software library.

Am I affected by CVE-2022-0764?

Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-0764: Strapi command injection in app creation

CVE-2022-0764 · Severity: low · CVSS 3 · Published 2022-02-27

Strapi is a headless CMS framework used to build content management systems. When creating a new Strapi application using the command-line tool, attackers can inject arbitrary shell commands through the template argument, potentially leading to unauthorized code execution during the setup process. An attacker would need local access or the ability to control the app creation parameters.

Technologies: strapi (npm). Vendors: npm.

Quick answers

Is CVE-2022-0764 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-0764 being exploited in the wild.
How severe is CVE-2022-0764?: Low severity, with a CVSS score of 3, published 27 February 2022.
Which products and versions are affected?: strapi (npm) SEMVER:introduced=0,fixed=4.1.0.
Is there a fix for CVE-2022-0764?: Yes. strapi (npm): upgrade to 4.1.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-0764 attacked?: It is attacked with local access, in a software library.
Am I affected by CVE-2022-0764?: Check whether you run strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

strapi (npm): upgrade to 4.1.0 or later
```
npm install strapi@4.1.0
```

Technical details

This vulnerability is a command injection flaw (CWE-77/CWE-78) in the Strapi app generator, specifically in the fetch-npm-template.js file used by `npx create-strapi-app`. The vulnerability stems from improper sanitization of the `--template` command-line argument, which is passed unsanitized to shell execution. An attacker with the ability to influence the app creation command (local access or via a deployment pipeline accepting user input) can inject arbitrary commands that execute with the privileges of the user running the `create-strapi-app` command. The vulnerability affects all versions prior to Strapi 4.1.0; v4 received a fix in commit 2a3f5e9, though v3 versions were not patched.

Affected products

Strapi Strapi < 4.1.0

Identifiers

CVE-2022-0764
GHSA-xrjf-phvv-r4vr

Timeline

2022-02-26: disclosed
2022: patched: Fixed in Strapi 4.1.0; v3 versions were not patched

References

https://github.com/strapi/strapi/issues/12879

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.