CVE-2022-31367: Strapi information disclosure via hidden attributes in admin API

CVE-2022-31367 · Severity: low · CVSS 3.1 · Published 2022-09-28

Strapi, a popular headless CMS platform, improperly exposes sensitive database attributes (such as password hashes) marked as "hidden" in API responses accessible to authenticated admin users. An authenticated administrator can retrieve sensitive data including user password hashes and other protected fields through API filtering manipulation, potentially enabling account compromise and unauthorized access.

Technologies: @strapi/strapi (npm), strapi (npm). Vendors: npm.

Quick answers

Is CVE-2022-31367 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2022-31367 being exploited in the wild.
How severe is CVE-2022-31367?
Low severity, with a CVSS score of 3.1, published 28 September 2022.
Which products and versions are affected?
@strapi/strapi (npm) SEMVER:introduced=4.0.0-next.0,fixed=4.1.10; strapi (npm) SEMVER:introduced=0,fixed=3.6.10.
Is there a fix for CVE-2022-31367?
Yes. @strapi/strapi (npm): upgrade to 4.1.10 or later; strapi (npm): upgrade to 3.6.10 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-31367 attacked?
It is attacked over the network.
Am I affected by CVE-2022-31367?
Check whether you run @strapi/strapi (npm) or strapi (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @strapi/strapi (npm): upgrade to 4.1.10 or later
    npm install @strapi/strapi@4.1.10
  • strapi (npm): upgrade to 3.6.10 or later
    npm install strapi@3.6.10

Technical details

This vulnerability is a column name injection / SQL injection flaw in Strapi's admin API filtering mechanism. When an authenticated user with "read user data" permissions uses the filter feature, the application fails to properly sanitize hidden attributes (fields marked as hidden in the content type configuration), returning them in API responses despite being intended to be hidden. An attacker can manipulate filter parameters (e.g., changing "email_contains" to "password_contains") to retrieve password hashes and other sensitive columns. The attack requires prior authentication and the targeted user permission level, but no additional user interaction. The vulnerability affects Strapi versions below 3.6.10 and 4.0.0 through 4.1.9. Patches were released on 2022-05-11 in versions 3.6.10 and 4.1.10, which sanitize hidden attributes from admin API responses.

Affected products

  • Strapi strapi < 3.6.10
  • Strapi @strapi/strapi 4.0.0-next.0 to < 4.1.10

Identifiers

  • CVE-2022-31367
  • GHSA-4phg-hpqm-c3j4

Timeline

  • 2021-12-09: disclosed: Vulnerability discovered
  • 2022-05-11: patched: Security patches released in v3.6.10 and v4.1.10
  • 2022-09-27: advisory: Public disclosure via CVE-2022-31367
  • 2022-09-28: advisory: GHSA advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.