CVE-2024-52588: Strapi server-side request forgery in webhook settings

CVE-2024-52588 · Severity: low · CVSS 3.1 · Published 2025-05-27

Strapi's webhook feature allows administrators to specify URLs for outbound callbacks. An attacker with admin privileges can input localhost or internal IP addresses, forcing the server to make requests to its own internal ports or services. This enables port scanning and potentially access to sensitive internal services, though it requires elevated administrative access to exploit.

Technologies: @strapi/admin (npm), Strapi Admin. Vendors: npm, Strapi.

Quick answers

Is CVE-2024-52588 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2024-52588 being exploited in the wild.
How severe is CVE-2024-52588?
Low severity, with a CVSS score of 3.1, published 27 May 2025.
Which products and versions are affected?
@strapi/admin (npm) SEMVER:introduced=0,fixed=4.25.2; Strapi Admin < 4.25.2.
Is there a fix for CVE-2024-52588?
Yes. @strapi/admin (npm): upgrade to 4.25.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2024-52588 attacked?
It is attacked over the network.
Am I affected by CVE-2024-52588?
Check whether you run @strapi/admin (npm) or Strapi Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • @strapi/admin (npm): upgrade to 4.25.2 or later
    npm install @strapi/admin@4.25.2

Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in Strapi's webhook URL input field. The vulnerable component fails to validate or restrict webhook URLs to external destinations, allowing an authenticated admin to specify internal addresses like 127.0.0.1, localhost, or 0.0.0.0. When the webhook is triggered, the Strapi server makes HTTP requests to these internal addresses, enabling port enumeration and potential information disclosure about running services. The vulnerability requires high-privilege admin access and does not allow code execution, but can reveal infrastructure details. Patches are available in version 4.25.2 and later.

Affected products

  • Strapi Admin < 4.25.2

Identifiers

  • CVE-2024-52588
  • GHSA-v8wj-f5c7-pvxf

Timeline

  • 2025-05-27: disclosed
  • 2025-05-27: patched: Fixed in version 4.25.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.