Executive brief
Strapi is a popular open-source headless CMS that provides a web-based admin panel for managing content. An authenticated admin user can view sensitive data including email addresses and password reset tokens for API users through content relationships, enabling account takeover if password reset endpoints are enabled. In the worst case, a low-privileged user could escalate to a high-privileged API account and gain full control of the system.
Technical details
The vulnerability is a sensitive information disclosure (CWE-212) affecting Strapi versions 3.0.0–3.6.8 and 4.0.0–4.1.8. An authenticated user with admin panel access can exploit improper data filtering to view private user data (email, password reset tokens) through relationships to the users-permissions API users, either directly or indirectly. The attack requires authentication to the admin panel but no additional user interaction. Exploitation allows account compromise and privilege escalation to high-privileged roles. Fixes are available in Strapi 3.6.9 and 4.1.9 or later.
Affected products
- Strapi Strapi 3.0.0–3.6.8, 4.0.0–4.1.8
Timeline
- 2022-05-20: disclosed
- 2022-05-20: patched: Fixes released in Strapi 3.6.9 and 4.1.9