Executive brief
The strapi-plugin-protected-populate is a Strapi plugin that restricts which database fields users are allowed to access during API requests. A vulnerability allows unauthenticated attackers to bypass these field-level restrictions and retrieve data they shouldn't have access to, potentially exposing sensitive information stored in protected fields.
Technical details
This is an authorization bypass vulnerability (CWE-863) in the field-level access control logic. When request fields are empty or contain only non-populatable fields, the plugin fails to properly enforce restrictions, allowing attackers to populate and retrieve fields they lack permission to access. The vulnerability is exploitable over the network with no authentication required and no user interaction. An attacker can retrieve unauthorized data by crafting API requests that bypass the security checks. The vulnerability was patched in version 1.3.4.
Affected products
- strapi-community strapi-plugin-protected-populate <1.3.4
Timeline
- 2023-11-20: disclosed
- 2023-11-20: patched: Fixed in version 1.3.4