Executive brief
Strapi, a popular open-source content management system, contains a vulnerability in its email template handling. An attacker with access to the administration panel can modify email templates to include malicious code. If successful, this allows the attacker to take full control of the server, potentially leading to data theft, service disruption, or further attacks on the internal network.
Technical details
A Server-Side Template Injection (SSTI) vulnerability exists in Strapi through version 4.5.5 within the Users-Permissions and Email plugins. The root cause is improper validation of lodash template delimiters (e.g., <% %>) in email templates, which allows for the evaluation of arbitrary JavaScript. An authenticated attacker with permissions to modify email templates via the admin panel (specifically via PUT requests to /users-permissions/email-templates) can bypass existing validation checks to achieve Remote Code Execution (RCE). While some NVD assessments require high privileges, other sources indicate the impact is critical due to the potential for full system compromise. The issue is fixed in version 4.5.6 by implementing stricter interpolation and deactivating evaluation in the template utility.
Affected products
- strapi strapi >= 3.0.0, < 4.5.6
- strapi @strapi/plugin-users-permissions <= 4.5.5
- strapi @strapi/plugin-email <= 4.5.5
Timeline
- 2023-01-10: patched: Fix merged into main branch
- 2023-04-18: advisory: GitHub Security Advisory published
- 2023-04-19: disclosed: NVD publication date
References
- https://github.com/strapi/strapi/security/advisories/GHSA-2h87-4q2w-v4hf
- https://github.com/strapi/strapi/pull/15385
- https://github.com/strapi/strapi/commit/921d30961d6ba96cc098f2aea197350a49f990bd
- https://github.com/strapi/strapi
- https://github.com/strapi/strapi/releases
- https://github.com/strapi/strapi/releases/tag/v4.5.6