Executive brief
Strapi is a popular open-source headless CMS platform used to manage content for web and mobile applications. A server-side request forgery (SSRF) vulnerability in Strapi's image handling component allows attackers to make unauthorized network requests from the server, potentially scanning internal networks, accessing sensitive services, or exfiltrating data from systems only reachable from the server.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Strapi v4.24.4, specifically in the /_next/image endpoint. The vulnerability is rooted in insufficient input validation on image URL parameters, allowing attackers to craft GET requests that cause the server to make arbitrary HTTP requests to internal or external targets. This is a network-accessible vulnerability requiring no authentication or user interaction. An attacker can exploit this to perform port scanning on internal networks, access internal services (databases, cloud metadata endpoints, administrative interfaces), or retrieve sensitive information. The vulnerability is classified as CWE-918 (SSRF). A fix is expected in a patched version of Strapi.
Affected products
- Strapi Strapi 4.24.4
Timeline
- 2024-06-20: disclosed
- 2024-10-04: other: GitHub reviewed