Executive brief
Strapi is a popular open-source headless CMS and API development platform. This vulnerability allows unauthenticated attackers to leak sensitive user information—including administrator passwords and password reset tokens—by filtering on private database fields. An attacker can exploit this to hijack admin accounts and gain full system control without needing any authentication or user interaction.
Technical details
The vulnerability is an information disclosure flaw (CWE-312) affecting Strapi versions 3.2.1 through 4.7.1. An unauthenticated attacker can craft GET requests with filters targeting private fields (email, password, resetPasswordToken) and infer sensitive values by observing changes in API responses. The attack requires network access to the Strapi API endpoint and no authentication. Successful exploitation allows leaking password hashes and password reset tokens, which can be used to hijack administrator accounts and gain Strapi Super Administrator privileges. The fix is available in Strapi 4.8.0 and later. Detection is straightforward via log analysis using the provided regex pattern for exploited GET parameters.
Affected products
- Strapi Strapi 3.2.1 through 4.7.1
Timeline
- 2023-04-19: disclosed: GHSA-jjqf-j4w7-92w8 and CVE-2023-22894 published
- 2023-04-19: patched: Fix released in Strapi 4.8.0