Executive brief
Strapi is an open-source headless CMS platform used to manage and deliver content across applications. A stored cross-site scripting vulnerability in the file upload functionality allows an attacker with administrative privileges to inject malicious scripts that execute in the browsers of other admin users, potentially leading to session hijacking, credential theft, or unauthorized actions on the CMS.
Technical details
The vulnerability is a stored cross-site scripting (CWE-79) flaw in Strapi versions 3.6.10 and earlier, triggered through the file upload functionality. An authenticated administrator can upload a file containing malicious JavaScript that is not properly sanitized, causing the script to execute when other privileged users view or interact with the uploaded file. The attack requires an authenticated account with administrative privileges and user interaction (viewing the malicious content), but once stored, the payload persists and affects multiple users. No patch information is provided in the available advisory data.
Affected products
- Strapi Strapi 3.6.10 and earlier
Timeline
- 2022-06-14: disclosed