Is CVE-2023-38507 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2023-38507 being exploited in the wild.

How severe is CVE-2023-38507?

Low severity, with a CVSS score of 3.1, published 13 September 2023.

Which products and versions are affected?

@strapi/admin (npm) SEMVER:introduced=0,fixed=4.12.1; @strapi/plugin-users-permissions (npm) SEMVER:introduced=0,fixed=4.12.1; Strapi Admin <= 4.12.0; Strapi Users & Permissions Plugin <= 4.12.0.

Is there a fix for CVE-2023-38507?

Yes. @strapi/admin (npm): upgrade to 4.12.1 or later; @strapi/plugin-users-permissions (npm): upgrade to 4.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2023-38507 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2023-38507?

Check whether you run @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-38507: Strapi rate limit bypass in admin login

Q: Is there a fix for CVE-2023-38507?

Yes. @strapi/admin (npm): upgrade to 4.12.1 or later; @strapi/plugin-users-permissions (npm): upgrade to 4.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2023-38507 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2023-38507?

Check whether you run @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2023-38507 · Severity: low · CVSS 3.1 · Published 2023-09-13

Strapi, a popular content management system, contains a flaw in how it handles login security. Attackers can bypass the system's rate-limiting protections, which are designed to prevent automated password guessing. This increases the risk of unauthorized access to the administrative dashboard through brute-force attacks.

Technologies: @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin, Strapi Users & Permissions Plugin. Vendors: npm, Strapi.

Quick answers

Is CVE-2023-38507 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2023-38507 being exploited in the wild.
How severe is CVE-2023-38507?: Low severity, with a CVSS score of 3.1, published 13 September 2023.
Which products and versions are affected?: @strapi/admin (npm) SEMVER:introduced=0,fixed=4.12.1; @strapi/plugin-users-permissions (npm) SEMVER:introduced=0,fixed=4.12.1; Strapi Admin <= 4.12.0; Strapi Users & Permissions Plugin <= 4.12.0.
Is there a fix for CVE-2023-38507?: Yes. @strapi/admin (npm): upgrade to 4.12.1 or later; @strapi/plugin-users-permissions (npm): upgrade to 4.12.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2023-38507 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2023-38507?: Check whether you run @strapi/admin (npm), @strapi/plugin-users-permissions (npm), Strapi Admin or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@strapi/admin (npm): upgrade to 4.12.1 or later
```
npm install @strapi/admin@4.12.1
```
@strapi/plugin-users-permissions (npm): upgrade to 4.12.1 or later
```
npm install @strapi/plugin-users-permissions@4.12.1
```

Technical details

An improper rate limiting vulnerability exists in Strapi's admin login functionality due to inconsistent path normalization in the rate-limiting middleware. The middleware uses the raw request path (ctx.request.path) as part of the cache key for tracking attempts. An attacker can bypass the limit by varying the casing of the URL (e.g., /admin/Login vs /admin/login) or by appending trailing slashes (e.g., /admin/login/). This allows for high-frequency brute-force attacks against administrative credentials. The issue is resolved in version 4.12.1 by normalizing request paths to lowercase and stripping trailing slashes before processing rate limits.

Affected products

Strapi @strapi/admin <= 4.12.0
Strapi @strapi/plugin-users-permissions <= 4.12.0

Identifiers

CVE-2023-38507
GHSA-24q2-59hm-rh9r

Timeline

2023-08-02: patched: Version 4.12.1 released
2023-09-13: disclosed: GitHub Advisory published
2023-09-15: advisory: NVD published CVE-2023-38507

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.