Executive brief
Strapi is a popular open-source headless CMS used to build and manage APIs for web and mobile applications. A vulnerability in the database filtering layer allows attackers to bypass access controls on private fields (such as admin passwords and reset tokens) by manipulating query prefixes, exposing sensitive user information without authentication.
Technical details
The vulnerability exists in Strapi's Knex query builder integration, where filtering protections only apply to fields referenced by their default prefix (e.g., `password`), but not when fields are prefixed with table aliases (e.g., `t1.password`). An unauthenticated attacker can craft malicious API filter parameters using custom table prefixes to bypass the field-level access controls, allowing them to perform prefix-based filtering attacks against joined tables and extract protected data like admin credentials and reset tokens. No authentication is required. The issue was fixed in @strapi/database and @strapi/utils version 4.10.8 and later.
Affected products
- Strapi @strapi/database <= 4.10.7
- Strapi @strapi/utils <= 4.10.7
Timeline
- 2023-07-25: disclosed
- 2023-07-25: patched: Fixed in version 4.10.8