# CVE-2024-52588: Strapi server-side request forgery in webhook settings

Source: https://junglewise.ai/threats/cve-2024-52588-strapi-server-side-request-forgery-in-webhook-settings  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-05-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-52588 · Severity: low · CVSS 3.1 · Published 2025-05-27

Strapi's webhook feature allows administrators to specify URLs for outbound callbacks. An attacker with admin privileges can input localhost or internal IP addresses, forcing the server to make requests to its own internal ports or services. This enables port scanning and potentially access to sensitive internal services, though it requires elevated administrative access to exploit.

Technologies: [@strapi/admin (npm)](https://junglewise.ai/threats/technologies/strapi-admin), [Strapi Admin](https://junglewise.ai/threats/technologies/admin). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Strapi](https://junglewise.ai/threats/vendors/strapi).

## Quick answers

**Is CVE-2024-52588 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-52588 being exploited in the wild.

**How severe is CVE-2024-52588?** Low severity, with a CVSS score of 3.1, published 27 May 2025.

**Which products and versions are affected?** @strapi/admin (npm) SEMVER:introduced=0,fixed=4.25.2; Strapi Admin < 4.25.2.

**Is there a fix for CVE-2024-52588?** Yes. @strapi/admin (npm): upgrade to 4.25.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-52588 attacked?** It is attacked over the network.

**Am I affected by CVE-2024-52588?** Check whether you run @strapi/admin (npm) or Strapi Admin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @strapi/admin (npm): upgrade to 4.25.2 or later

  ```sh
  npm install @strapi/admin@4.25.2
  ```


## Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) in Strapi's webhook URL input field. The vulnerable component fails to validate or restrict webhook URLs to external destinations, allowing an authenticated admin to specify internal addresses like 127.0.0.1, localhost, or 0.0.0.0. When the webhook is triggered, the Strapi server makes HTTP requests to these internal addresses, enabling port enumeration and potential information disclosure about running services. The vulnerability requires high-privilege admin access and does not allow code execution, but can reveal infrastructure details. Patches are available in version 4.25.2 and later.

## Affected products

- Strapi Admin < 4.25.2

## Identifiers

- CVE-2024-52588
- GHSA-v8wj-f5c7-pvxf

## Timeline

- 2025-05-27: disclosed
- 2025-05-27: patched: Fixed in version 4.25.2

## References

- [https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf](https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf)

## Related threats

- [Strapi insufficient session invalidation during password reset](https://junglewise.ai/threats/cve-2026-22706-strapi-insufficient-session-invalidation-during-password-reset)
- [Strapi rate limit bypass in admin login](https://junglewise.ai/threats/cve-2023-38507-strapi-rate-limit-bypass-in-admin-login)
- [Strapi information disclosure in content-manager relations view](https://junglewise.ai/threats/cve-2023-36472-strapi-information-disclosure-in-content-manager-relations-view)
- [Strapi denial of service in admin plugin management](https://junglewise.ai/threats/cve-2020-8123-strapi-denial-of-service-in-admin-plugin-management)