Strapi · Strapi
Strapi through 4.5.5 contains a cleartext storage of sensitive information flaw in its query filter handling, which lets users of the admin panel infer sensitive user data from API responses. An attacker with admin panel access can exploit it over the network without user interaction; with super admin access they can recover every user's password hash and password reset token, while with access to an account limited to a lower-privileged role such as Editor or Author they can obtain the username and email of API users but not other admin accounts.
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
First seen exploited 3 years after disclosure. Public exploit code (PoC-in-GitHub) appeared 5 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
7 fixes in @strapi/strapi over 3 years. The latest fix listed for @strapi/strapi is 5.24.1.
Requires legitimate admin panel account access
allows attackers (with access to the admin panel) to discover sensitive user details
Extracts password hashes and reset tokens from users
If the attacker has super admin access, then this can be exploited to discover the password hash
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
1 package in 1 ecosystem. Main package: @strapi/strapi.
Upgrade to 4.8.0 or later
npm install @strapi/strapi@4.8.0The first fix for CVE-2023-22894. No other CVE tracked by Patchfirst affects this package.
| If you run | Upgrade to |
|---|---|
| 3.2.1 up to 4.8.0 | 4.8.0 |
“Up to” means the second version is the fix and is not affected.
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.