Executive brief
Strapi is a headless CMS framework used to build content management systems. When creating a new Strapi application using the command-line tool, attackers can inject arbitrary shell commands through the template argument, potentially leading to unauthorized code execution during the setup process. An attacker would need local access or the ability to control the app creation parameters.
Technical details
This vulnerability is a command injection flaw (CWE-77/CWE-78) in the Strapi app generator, specifically in the fetch-npm-template.js file used by `npx create-strapi-app`. The vulnerability stems from improper sanitization of the `--template` command-line argument, which is passed unsanitized to shell execution. An attacker with the ability to influence the app creation command (local access or via a deployment pipeline accepting user input) can inject arbitrary commands that execute with the privileges of the user running the `create-strapi-app` command. The vulnerability affects all versions prior to Strapi 4.1.0; v4 received a fix in commit 2a3f5e9, though v3 versions were not patched.
Affected products
- Strapi Strapi < 4.1.0
Timeline
- 2022-02-26: disclosed
- 2022: patched: Fixed in Strapi 4.1.0; v3 versions were not patched