Headless CMS

Definitions & benefits

Tools & Concepts

Open source

Features

Authentication

Custom plugins & Marketplace

Webhooks

Multilingual CMS

APIs

Dynamic Zones

User roles & permissions

Content Modeling

Security & Privacy

Use Cases

Ecommerce

Blog

Forum

About Strapi

Life at Strapi

Releases & Roadmap

Events

Community

News

The Tutorials section covers an introduction to Strapi, some advanced technical content, product updates and releases. From basic workaround to in-depth development guides. 

Tutorials

How tos

Get all the latest updates, news and events.

Subscribe to the newsletter 📣

## Disclosure Summary

Thanks to three community members, we have been notified and patched four security vulnerabilities: 

- CVE-2023-36472: [GHSA-v8gg-4mq2-88q4](https://github.com/strapi/strapi/security/advisories/GHSA-v8gg-4mq2-88q4)
- CVE-2023-38507: [GHSA-24q2-59hm-rh9r](https://github.com/strapi/strapi/security/advisories/GHSA-24q2-59hm-rh9r)
- CVE-2023-37263: [GHSA-m284-85mf-cgrc](https://github.com/strapi/strapi/security/advisories/GHSA-m284-85mf-cgrc)
- CVE-2023-39345: [GHSA-gc7p-j5xm-xxh2](https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2)

Per our [security policy](https://github.com/strapi/strapi/security/policy), we are performing our due diligence by publicly disclosing these vulnerabilities after careful testing, validation, communication, and our mandatory waiting period. For further details of the patched vulnerabilities, please refer to the information below or consult the linked GitHub Advisories.

We would like to thank the following community members for their participation in our security program:

- [Boegie19](https://github.com/Boegie19) for reporting CVE-2023-36472 & CVE-2023-37263
- [scgajge12](https://github.com/scgajge12) for reporting CVE-2023-38507 - [Twitter](https://twitter.com/scgajge12) [website](https://scgajge12.github.io/)
- [dogusdeniz](https://github.com/dogusdeniz) for reporting CVE-2023-39345

### Immediate resolution steps for all vulnerabilities disclosed here

To immediately resolve all vulnerabilities detailed in this post, please update all of your Strapi packages to version **v4.13.5**. To upgrade your Strapi application either for self-hosted (community & enterprise) and Strapi Cloud please see our [update guide](https://docs.strapi.io/dev-docs/update-version) and any relevant [migration guides](https://docs.strapi.io/dev-docs/migration-guides).

Note that the patched version was originally v4.13.1 however, there were a few hotfixes for some unrelated issues which is why we recommend upgrading straight to v4.13.5 or greater.

## CVE-2023-36472: Leaking sensitive user information, user reset password tokens, via content-manager views

### Summary of CVE-2023-36472 Vulnerability Details

- CVE: CVE-2023-36472
- CVSS v3.1 Vector: `CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N`
- Affected Versions: <=4.11.6
- How to Patch: Immediately update your Strapi to version >=4.11.7

### Description of CVE-2023-36472

The content-manager plugin was not configured to filter out specific types of fields that cannot be assigned to views or, if allowed to be shown and these types were a relation it was possible to select a main field to be shown in the relation dropdown that included the value. This was corrected by properly limiting certain attributes from being unable to be shown within the content-manager views or by taking advantage of the previously built sanitization functions not to send the values of these to the admin panel.

This vulnerability requires direct authorized access to the Strapi admin panel and requires permissions to be able to modify the content-manager views.

### IoC's for CVE-2023-36472

Review your content-manager views to ensure the main fields were not changed to private attributes. Due to the nature of this vulnerability, there are no other indicators of compromise.

### Timeline for CVE-2023-36472

| Time | Event |
| ---- | ----- |
| 2023/06/19 08:35am GMT | Report of the vulnerability received by the Strapi Security Team |
| 2023/06/28 06:55am GMT | Vulnerability report was accepted by the Strapi Team |
| 2023/06/28 02:10pm GMT | Patch developed and pushed to internal fork for testing |
| 2023/06/28 02:22pm GMT | Patch verified internally and merged into the main codebase |
| 2023/06/28 12:36pm GMT | Experimental release as created and passed to the reporter to verify patch |
| 2023/06/28 01:49pm GMT | Reporter verified patch worked as expected |
| 2023/06/28 02:15pm GMT | Patch was released in Strapi version [v4.11.7](https://github.com/strapi/strapi/releases/tag/v4.11.7) |
| 2023/06/28 03:03pm GMT | GitHub issued CVE-2023-36472 per our request |
| 2023/06/28 03:15pm GMT | Disclosure communication placed on hold due to internal requirements and other vulnerability work being performed |
| 2023/07/20 05:21pm GMT | Disclosure placed on hold due to another related vulnerability |
| 2023/07/20 05:21pm GMT | New waiting period of an additional 2 weeks initiated |
| 2023/08/25 09:31pm GMT | Disclosure placed on hold due to another related vulnerability |
| 2023/08/31 10:44pm GMT | Initial warning email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |
| 2023/08/31 10:44pm GMT | Mandatory waiting period of 2 weeks initiated |
| 2023/09/13 05:00pm GMT | Released the full disclosure of the vulnerability and published GitHub Advisories |
| 2023/09/13 08:00pm GMT | Disclosure email was sent out to all Strapi Enterprise and Cloud Customers, including Strapi partners with active enterprise contracts |

## CVE-2023-38507: Improper Rate Limiting

### Summary of CVE-2023-38507 Vulnerability Details

- CVE: CVE-2023-38507
- CVSS v3.1 Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L`
- Affected Versions: <=4.12.0
- How to Patch: Immediately update your Strapi to version >=4.12.1

### Description of CVE-2023-38507

Due to a bug in the way the default rate-limiting middlewares were constructed and due to the way Koa.js parses the path when checking against `koa-router`, it was possible to bypass the rate limits by slightly altering the API requests and swapping out lower-case letters from upper-case or by adding a trailing slash to the request. Koa router will by default handle this when running the regex to match the routes but it does not update the internal reference within the `ctx.request` object and as such our default middlewares were constructing a rate-limit key that took the `ctx.request.path` literally with no transformation. This was corrected by properly constructing a new key that forces the path to lowercase and removes any extra trailing slash for the purposes of rate-limiting. Both the admin-api and users-permissions auth endpoints were fixed and their rate-limit middlewares harmonized to ensure the same rate-limit logic is applied to both in the correct way.

### IoC's for CVE-2023-38507

Review your application logs to check for a large number of failed authentication requests in a short period of time. Due to the nature of this vulnerability, there are no other indicators of compromise.

### Timeline for CVE-2023-38507

| Time | Event |
| ---- | ----- |
| 2023/06/05 07:55pm GMT | Report of the vulnerability received by the Strapi Security Team |
| 2023/06/12 09:27am GMT | Vulnerability report was accepted by the Strapi Team |
| 2023/06/21 03:58pm GMT | Reporter provided additional reproduction information and similar CVEs from other software |
| 2023/06/29 11:13pm GMT | Reporter asked for an update on when patch development would start |
| 2023/07/03 07:29pm GMT | Patch developer notified reporter that patch development would begin soon as we had some people on vacation |
| 2023/07/17 09:00pm GMT | Patch was developed and internal private PR created |
| 2023/07/17 09:00pm GMT | An experimental release was made with the changes communicated previously for testing |
| 2023/07/17 12:19am GMT | Reporter notified the Strapi Security Team that an additional workaround to the fix could still lead to vuln |
| 2023/07/19 07:27am GMT | Patch updated to fix additional workaround and new experimental released |
| 2023/07/26 01:19pm GMT | GitHub issued CVE-2023-38507 per our request |
| 2023/07/26 01:19pm GMT | Patch was released in Strapi version [v4.12.1](https://github.com/strapi/strapi/releases/tag/v4.12.1) |
| 2023/08/03 09:23pm GMT | Disclosure communication placed on hold due to internal requirements and other vulnerability work being performed |
| 2023/08/25 09:31pm GMT | Disclosure placed on hold due to another related vulnerability |
| 2023/08/31 10:44pm GMT | Initial warning email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |
| 2023/08/31 10:44pm GMT | Mandatory waiting period of 2 weeks initiated |
| 2023/09/13 05:00pm GMT | Released the full disclosure of the vulnerability and published GitHub Advisories |
| 2023/09/13 08:00pm GMT | Disclosure email was sent out to all Strapi Enterprise and Cloud Customers, including Strapi partners with active enterprise contracts |

## CVE-2023-37263: Field level permissions not being respected in relationship title

### Summary of CVE-2023-37263 Vulnerability Details

- CVE: CVE-2023-37263
- CVSS v3.1 Vector: `CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N`
- Affected Versions: <=4.12.0
- How to Patch: Immediately update your Strapi to version >=4.12.1

### Description of CVE-2023-37263

RBAC permissions were not being properly respected within the content-manager views allowing for private fields to be set as the entity title within the content-manager edit view. This was resolved; a check was added to validate if a set field is private or sensitive in nature and will no longer be shown as an option to the user to change the entity title too. Likewise, if any were changed they will instead default back to the entity's ID without any user modification needed.

### IoC's for CVE-2023-37263

Review your content-manager views to ensure the title field was not changed to a private attribute. Due to the nature of this vulnerability, there are no other indicators of compromise.

### Timeline for CVE-2023-37263

| Time | Event |
| ---- | ----- |
| 2023/07/01 04:46pm GMT | Report of the vulnerability received by the Strapi Security Team |
| 2023/07/06 04:26pm GMT | Vulnerability report was accepted by the Strapi Team |
| 2023/07/06 04:26pm GMT | GitHub issued CVE-2023-37263 per our request |
| 2023/07/25 03:34pm GMT | An experimental release was made with the changes communicated previously for testing |
| 2023/07/27 02:18pm GMT | Patch was released in Strapi version [v4.12.1](https://github.com/strapi/strapi/releases/tag/v4.12.1) |
| 2023/08/03 09:32pm GMT | Disclosure communication placed on hold due to internal requirements and other vulnerability work being performed |
| 2023/08/25 09:31pm GMT | Disclosure placed on hold due to another related vulnerability |
| 2023/08/31 10:44pm GMT | Initial warning email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |
| 2023/08/31 10:44pm GMT | Mandatory waiting period of 2 weeks initiated |
| 2023/09/13 05:00pm GMT | Released the full disclosure of the vulnerability and published GitHub Advisories |
| 2023/09/13 08:00pm GMT | Disclosure email was sent out to all Strapi Enterprise and Cloud Customers, including Strapi partners with active enterprise contracts |

## CVE-2023-39345: Unauthorized Access to Private Fields in User Registration API

### Summary of CVE-2023-39345 Vulnerability Details

- CVE: CVE-2023-39345
- CVSS v3.1 Vector: `CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L`
- Affected Versions: <4.13.1
- How to Patch: Immediately update your Strapi to version >=4.13.5

### Description of CVE-2023-39345

In Strapi versions prior to v4.13.1, custom fields added to the users-permissions user were not properly validated or sanitized during registration as we were only handling fields which Strapi originally added.

For the fix on this, we opted to continue to allow users to handle custom fields during registration but added both a warning to users when the app starts and some configuration options to let them strictly control which custom fields are allowed to be set during registion (calling the `/api/auth/local/register` route).

For this vulnerability, we opted not to construct any IoCs since generally, it required manual user input for some custom fields but if you are unsure review your users-permissions content-type for any fields you added and check your registered users to confirm which fields have data in them and if they should.

For additional details on how to configure the allowed fields in this version please see the following [documentation](https://docs.strapi.io/dev-docs/plugins/users-permissions#configuration).

### Timeline for CVE-2023-39345

| Time | Event |
| ---- | ----- |
| 2023/06/19 01:22am GMT | Report of the vulnerability received by the Strapi Security Team |
| 2023/07/07 06:04pm GMT | Vulnerability report was accepted by the Strapi Team |
| 2023/07/20 04:43pm GMT | An experimental release was made with the changes communicated previously for testing |
| 2023/08/04 06:45pm GMT | GitHub issued CVE-2023-39345 per our request |
| 2023/08/30 03:20pm GMT | Patch was released in Strapi version [v4.13.1](https://github.com/strapi/strapi/releases/tag/v4.13.1) |
| 2023/08/31 10:44pm GMT | Initial warning email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |
| 2023/08/31 10:44pm GMT | Mandatory waiting period of 2 weeks initiated |
| 2023/09/13 05:00pm GMT | Released the full disclosure of the vulnerability and published GitHub Advisories |
| 2023/09/13 08:00pm GMT | Disclosure email was sent out to all Strapi Enterprise and Cloud Customers, including Strapi partners with active enterprise contracts |

## Commitment to Responsible Disclosure

We at Strapi do believe in responsible disclosure. In the case of these vulnerabilities, we have worked with the security researcher to ensure that the vulnerabilities were patched before the full disclosure of the vulnerabilities. Once a vulnerability is patched, we added a notice to our release notes to inform users there was a security vulnerability but initially wanted to delay detailed disclosure for a few weeks to give time for users to upgrade before the release of the full disclosure. As an additional step, we immediately notified our customers via several emails beforehand to ensure they were aware of the vulnerabilities and to upgrade their Strapi servers.

In this case, we believe that delaying the detailed disclosure was important to ensure that users had the time required to upgrade their Strapi servers before making the details of each vulnerability public, thus placing that information in the hands of bad actors. We also believe that the security researcher was very professional and responsible in handling the vulnerabilities, and we are very thankful for their work in helping us improve the security of Strapi.

We urge anyone who believes they have discovered a security vulnerability to assist us in responsibly disclosing the vulnerability to us by [submitting a GitHub Advisory on our main repo](https://github.com/strapi/strapi/security/advisories/new) or by contacting our security team via [security@strapi.io](mailto:security@strapi.io).

Thanks,

The Strapi Security Team

This article details and discloses four security vulnerabilities and recommends immediate upgrading to fix them.

The Product section covers our releases, feature reviews and more. 

Product

large_Security Desclosure.jpg

medium_Security Desclosure.jpg

small_Security Desclosure.jpg

thumbnail_Security Desclosure.jpg

Security Desclosure.jpg

Security Disclosure of Vulnerabilities: CVE-2023-36472, CVE-2023-38507, CVE-2023-37263, and CVE-2023-39345

Phoenix

User Success

## Disclosure Summary

Thanks to 2 community members and some of our internal team, we have been notified and patched two security vulnerabilities: 

- CVE-2023-34235: [GHSA-9xg4-3qfm-9w8f](https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f)
- CVE-2023-34093: [GHSA-chmr-rg2f-9jmf](https://github.com/strapi/strapi/security/advisories/GHSA-chmr-rg2f-9jmf)

Per our [security policy](https://github.com/strapi/strapi/security/policy), we are performing our due diligence by publicly disclosing these vulnerabilities after careful testing, validation, communication, and our mandatory waiting period. For further details of the patched vulnerabilities, please refer to the information below or consult the linked GitHub Advisories.

We would like to thank the following community members for their participation in our security program:

- [Boegie19](https://github.com/Boegie19) for alerting us to CVE-2023-34235
- [Ccamm](https://github.com/Ccamm) for the awesome write up of CVE-2023-34235 in combo with Boegie19, you can view their [blog post](https://www.ghostccamm.com/blog/strapi_filter_bypass_vuln) for additional details of this vuln

Likewise, a shoutout to 3 of our team members for alerting us to CVE-2023-34093.

- [Nathan P](https://github.com/nathan-pichon)
- [Marc R](https://github.com/Marc-Roig)
- [Ben I](https://github.com/innerdvations)

### Immediate resolution steps for all vulnerabilities disclosed here

To immediately resolve all vulnerabilities detailed in this post, please update all of your Strapi packages to version >=4.11.4.

## CVE-2023-34235: Leaking sensitive user information is still possible by filtering on private with prefix fields

### Summary of CVE-2023-34235 Vulnerability Details

- CVE: CVE-2023-34235
- CVSS v3.1 Vector: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N`
- Affected Versions: <=4.10.7
- How to Patch: Immediately update your Strapi to version >=4.10.8

### Description of CVE-2023-34235

This vulnerability bypassed previous fixes to our sanitization system by using functions provided by Knex on relational joins. By forcefully injecting SQL join syntax such as `t0`, `t1`, etc. you could effectively fetch private field data such as password reset tokens. An example of such filtering syntax would be as such:

`localhost:1338/api/tests?filters[updatedBy][t1.email][$startsWith]=test2&populate=*`

We resolved this issue by forcing request sanitization to limit filters only to attributes that exist within the content-type and strictly removing any filters that are not allowed (such as private fields). Due to the extremely complex nature of this vulnerability and the requirement to have either relations set up to a content-type containing private fields or creator fields enabled on a content-type, we do not believe this vulnerability was actively used in the wild before disclosure.

### IoC's for CVE-2023-34235

We advise reviewing your Strapi application logs and searching for any references to `[t0.`, `[t1.`, etc. to determine if such filters were attempted to be used against your application. You can use the following regex pattern when reviewing your application logs: `filters.*(\[|%5B)\s*t\d+\.(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)`.

### Timeline for CVE-2023-34235

| Time | Event |
| ---- | ----- |
| 2023/05/02 5:46pm GMT | Report of the vulnerability received by the Strapi Security Team |
| 2023/05/05 8:15am GMT | Vulnerability report was accepted by the Strapi Team |
| 2023/05/05 11:27am GMT | The Strapi Engineering Team communicated to the reporter our planned changes to get their feedback |
| 2023/05/07 5:30pm GMT | The reporter acknowledged and agreed with our planned changes |
| 2023/06/07 8:12am GMT | An experimental release was made with the changes communicated previously for testing |
| 2023/06/07 3:42pm GMT | GitHub issued CVE-2023-34235 per our request |
| 2023/06/07 1:08pm GMT | Patch was released in Strapi version [v4.10.8](https://github.com/strapi/strapi/releases/tag/v4.10.8) |
| 2023/06/07 3:00pm GMT | Disclosure communication placed on hold due to internal requirements and other vulnerability work being performed |
| 2023/07/10 7:25pm GMT | Initial warning email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |
| 2023/07/10 7:25pm GMT | Mandatory waiting period of 2 weeks initiated |
| 2023/07/25 1:01pm GMT | Released the full disclosure of the vulnerability and published GitHub Advisories |
| 2023/07/25 1:01pm GMT | Disclosure email was sent out to all Strapi Enterprise and Cloud Customers, including Strapi partners with active enterprise contracts |

## CVE-2023-34093: Making all attributes on a content-type public via review workflows

### Summary of CVE-2023-34093 Vulnerability Details

- CVE: CVE-2023-34093
- CVSS v3.1 Vector: `CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:L/A:N`
- Affected Versions: <=4.10.7
- How to Patch: Immediately update your Strapi to version >=4.10.8

### Description of CVE-2023-34093

This vulnerability only applies to Strapi Enterprise and Cloud customers. It requires specific customization to be done that extends content types during runtime (aka bootstrap functions) that copies the content-type object such as:

```js
strapi.container.get('content-types').extend(contentTypeUID, (contentType) => {
 const newCT = { ... contentType, attributes: { ...contentType.attributes, newAttr: {} } };
 return newCT;
});
```

This will have the effect of removing the getter, and as we rely on it in sanitization, all attributes will be considered public. If you were extending and not copying the content-type object, then you were not affected.

### IoC's for CVE-2023-34093

Review your code if you are extending content-types at runtime to ensure you are not copying the object and instead are just mutating it. If you have not done any such customization, then you are not impacted. A proper example of extending a content-type is as such:

```js
strapi.container.get('content-types').extend(contentTypeUID, (contentType) => newContentType);
```

### Timeline for CVE-2023-34093

| Time | Event |
| ---- | ----- |
| 2023/05/30 3:23pm GMT | Report of the vulnerability received by the Strapi Security Team via an internal source |
| 2023/05/30 3:28pm GMT | Vulnerability report was accepted by the Strapi Team |
| 2023/05/31 11:08am GMT | Patch developed and pushed to internal fork for testing |
| 2023/06/01 1:38pm GMT | Patch verified and merged into the main codebase |
| 2023/06/01 2:27pm GMT | GitHub issued CVE-2023-34093 per our request |
| 2023/06/07 1:08pm GMT | Patch was released in Strapi version [v4.10.8](https://github.com/strapi/strapi/releases/tag/v4.10.8) |
| 2023/06/07 3:00pm GMT | Disclosure communication placed on hold due to internal requirements and other vulnerability work being performed |
| 2023/07/10 7:25pm GMT | Initial warning email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |
| 2023/07/10 7:25pm GMT | Mandatory waiting period of 2 weeks initiated |
| 2022/07/25 1:01pm GMT | Released the full disclosure of the vulnerability and published GitHub Advisories |
| 2022/07/25 1:01pm GMT | Disclosure email was sent out to all Strapi Enterprise and Cloud Customers including Strapi partners with active enterprise contracts |

## Commitment to Responsible Disclosure

We at Strapi do believe in responsible disclosure. In the case of these vulnerabilities, we have worked with the security researcher to ensure that the vulnerabilities were patched before the full disclosure of the vulnerabilities. Once a vulnerability is patched, we added a notice to our release notes to inform users there was a security vulnerability but initially wanted to delay detailed disclosure for a few weeks to give time for users to upgrade before the release of the full disclosure. As an additional step, we immediately notified our customers via several emails beforehand to ensure they were aware of the vulnerabilities and to upgrade their Strapi servers.

In this case, we believe that delaying the detailed disclosure was important to ensure that users had the time required to upgrade their Strapi servers before making the details of each vulnerability public, thus placing that information in the hands of bad actors. We also believe that the security researcher was very professional and responsible in handling the vulnerabilities, and we are very thankful for their work in helping us improve the security of Strapi.

We urge anyone who believes they have discovered a security vulnerability to assist us in responsibly disclosing the vulnerability to us by [submitting a GitHub Advisory on our main repo](https://github.com/strapi/strapi/security/advisories/new) or by contacting our security team via security@strapi.io.

Thanks,

The Strapi Security Team

This article details and discloses two security vulnerabilities and recommends immediate upgrading to fix them.

Security Disclosure of Vulnerabilities_ CVE-2023-34235 and CVE-2023-34093

medium_Security Disclosure of Vulnerabilities_ CVE-2023-34235 and CVE-2023-34093.png

small_Security Disclosure of Vulnerabilities_ CVE-2023-34235 and CVE-2023-34093.png

thumbnail_Security Disclosure of Vulnerabilities_ CVE-2023-34235 and CVE-2023-34093.png

Security Disclosure of Vulnerabilities_ CVE-2023-34235 and CVE-2023-34093.png

Security Disclosure of Vulnerabilities: CVE-2023-34235 and CVE-2023-34093

## CVE-2023-22621: SSTI to RCE in the Users-Permissions Plugin

### Summary of CVE-2023-22621 Vulnerability Details

- **CVE:** CVE-2023-22621
- **CVSS v3.1 Vector:** [AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H&version=3.1)
- **Affected Versions:** <=4.5.5
- **How to Patch:** Immediately **update** your Strapi to version **>=4.5.6**! If you using Strapi **3.x.x** or below, [**IMMEDIATELY UPDATE TO A PATCHED 4.x.x VERSION!**](https://docs.strapi.io/dev-docs/update-version) Strapi versions 3.x.x reached its **end of life support on the December 31st 2022**, and will no longer receive security updates. If you are unable to upgrade to a patched version, please see the [following repository](https://github.com/strapi/security-patches) for patch-package patches.

### Description of CVE-2023-22621

On December 29th, 2022, the security researcher reported to us an SSTI (server-side template injection) vulnerability impacting our [users-permission plugin’s](https://docs.strapi.io/dev-docs/plugins/users-permissions) email template system. Please note the users-permissions plugin is installed by default. This SSTI vulnerability made it possible to modify the email template to execute malicious code via RCE (remote code execution). This vulnerability’s scope was originally believed to be exploitable only if a malicious actor had access to the Strapi Admin Panel. On January 4th 2022, a CVE was submitted in a draft state with the following ID: CVE-2023-22621.

While we won’t go into the deep details of this vulnerability (please see the related blog post by the security researcher who reported the vulnerability to us) we did want to communicate on the IoC’s (indicators of compromise) so that our users are able to review their application logs to detect if they were impacted. Do note that this vulnerability impacts all known Strapi v3 and Strapi v4 versions prior to v4.5.6. If you have not [already upgraded](https://docs.strapi.io/dev-docs/update-version) beyond Strapi v4.5.6 we do urge you to do so as quickly as possible (we strongly advise upgrading beyond v4.8.0 where other security vulnerabilities were patched). If you are unable to upgrade we have released several patch-package patches for this particular vulnerability.

### CVE-2023-22621 IoC’s

Using just the request log files, the only IoC to search for is a `PUT` request to URL path `/users-permissions/email-templates`. This IoC only indicates that a Strapi email template was modified on your server and by itself does not indicate if your Strapi server has been compromised. If this IoC is detected, you will need to manually review your email templates on your Strapi server and backups of your database to see if any of the templates contain a `lodash` template delimiter (eg. `<%STUFF HERE%>`) that contains suspicious JavaScript code. Generally speaking these templates should look like the following, you may have minor adjustments but any unrecognized code should be considered suspicious.

Reset Password Template:

```html
We heard that you lost your password. Sorry about that!

But don’t worry! You can use the following link to reset your password:
<%= URL %>?code=<%= TOKEN %>

Thanks.
```

Email Confirmation Template:

```html
Thank you for registering!

You have to confirm your email address. Please click on the link below.

<%= URL %>?confirmation=<%= CODE %>

Thanks.
```

Specifically you should look for odd code contained within the `<%STUFF HERE%>` blocks as this is what is used to bypass the lodash templating system. If you find any code that is not a variable name, or a variable name that is not defined in the template you are most likely impacted and should take immediate steps to confirm there are no malicious applications running on your servers.

### CVE-2023-22621 Timeline

| Time | Event |
| ---- | ----- |
| 2022/12/30 02:40 AM UTC | Report of the vulnerability received by the Strapi security team. |
| 2022/12/30 02:57 AM UTC | Sent first response acknowledging the report and began testing reproduction. |
| 2022/12/30 02:12 PM UTC | Confirmation sent that we were able to successfully reproduce the vulnerability and provided an estimated 1 week timeline to patch the vulnerability due to the holiday period. |
| 2023/01/02 02:39 AM UTC | Security Researcher sent request to Mitre to reserve a CVE ID for this vulnerability. |
| 2023/01/03 08:00 PM UTC | Strapi team developed a fix for this vulnerability and released a nightly build for testing the patch. |
| 2023/01/05 12:09 AM UTC | Mitre reserved CVE ID `CVE-2023-22621` for this vulnerability. |
| 2023/01/08 08:13 AM UTC | Security researcher identified a minor issue with the patch. |
| 2023/01/10 10:00 AM UTC | Strapi team fixed the minor issue with the patch. |
| 2023/01/11 04:00 PM UTC | [Strapi released version **4.5.6**](https://github.com/strapi/strapi/releases/tag/v4.5.6) with the patch and announced a security warning for previous versions. |
| 2023/01/18 08:05 AM UTC | We were informed of a method of exploiting **CVE-2023-22894** to hijack admin accounts, that enables this vulnerability being exploited as an **unauthenticated user**. |
| 2023/01/19 03:08 PM UTC | Strapi and the security researcher both decided to delay the public disclosure of this vulnerability until **CVE-2023-22894** has been patched. |
| 2023/04/17 09:00 AM UTC | Released the full disclosure of the vulnerability. |

## CVE-2023-22893: Authentication Bypass for AWS Cognito Login Provider

### Summary of CVE-2023-22893 Vulnerability Details

- **CVE:** CVE-2023-22893
- **CVSS v3.1 Vector:** [AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N&version=3.1)
- **Impacted Versions:** >=3.2.1,<4.6.0
- **How to Patch:** Immediately **update** your Strapi to version **>=4.6.0**! If you using Strapi **3.x.x** or below, [**IMMEDIATELY UPDATE TO A PATCHED 4.x.x VERSION!**](https://docs.strapi.io/dev-docs/update-version) Strapi versions 3.x.x reached its **end of life support on the December 31st 2022**, and would **not receive a patch** for this vulnerability!

### Description of CVE-2023-22893

On January 1st, 2023, the security researcher reported to us an authentication bypass specifically for the AWS Cognito authentication provider for the users-permissions plugin. This vulnerability made it possible for any user to authenticate against a Strapi application using this authentication provider by spoofing the JWT token using a valid victims email address as the contents of the JWT were not properly verified against AWS. This vulnerability only impacted the users-permissions plugin and not Strapi Enterprise's SSO feature as the two systems use entirely different authentication provider packages (users-permissions uses Grant/Purest whereas the Admin Panel uses Passport.js).

While we won’t go into the deep details of this vulnerability (please see the related blog post by the security researcher who reported the vulnerability to us) we did want to communicate on the IoC’s (indicators of compromise) so that our users are able to review their application logs to detect if they were impacted. Do note that this vulnerability impacts all known Strapi v3 and Strapi v4 versions prior to v4.6.0. If you have not already upgraded beyond Strapi v4.6.0 we do urge you to do so as quickly as possible (we strongly advise upgrading beyond v4.8.0 where other security vulnerabilities were patched). **Again please note that if you do not currently use the AWS Cognito authentication provider you are not impacted by this vulnerability.**

### CVE-2023-22893 IoC’s

Reviewing of application logs is recommended to detect any suspicious activity. Running the following regex pattern will extract all ID tokens sent to `/api/auth/cognito/callback`

```js
/\/api\/auth\/cognito\/callback\?[\s\S]*id_token=\s*([\S]*)/
```

Once you have a list of the ID tokens, you will need to verify each token using the **public key file for your AWS Cognito user pool** that you can download from `https://cognito-idp.{region}.amazonaws.com/{userPoolId}/.well-known/jwks.json`. If there are any JWT tokens that cannot be verified using the correct public key, then you need to inspect the JWT body and see if it contains the `email` and `cognito:username` claims (example below).

```json
{
 "cognito:username": "auth-bypass-example",
 "email": "user@example.com"
}
```

If there are any JWTs that have this body, verify when the account with the email address was created. If the account was created earlier than the request to `/api/auth/cognito/callback` with the invalid JWT token, then you need to **contact the user to inform them their account has been breached**!

After upgrading to Strapi v4.6.0 or greater you will need to reconfigure your AWS Cognito provider to include the JWKS URL for it to work properly. If you do not reconfigure your provider you will receive an error message when attempting to login.

### CVE-2023-22893 Timeline

| Time | Event |
| ---- | ----- |
| 2023/01/01 09:14 AM UTC | Report of the vulnerability received by the Strapi security team. |
| 2023/01/01 08:35 PM UTC | Sent first response acknowledging the report and began testing reproduction. |
| 2023/01/04 10:53 AM UTC | Confirmation sent that we were able to successfully reproduce the vulnerability. |
| 2023/01/09 01:06 AM UTC | Mitre reserved CVE ID `CVE-2023-22893` for this vulnerability. |
| 2023/01/09 04:49 PM UTC | The Strapi team developed a fix for this vulnerability and released a nightly build for testing the patch. |
| 2023/01/10 12:19 PM UTC | From a static analysis, the security researcher reported to Strapi that the fix still had an authentication bypass vulnerability by modifying the `iss` claim. |
| 2023/01/11 11:57 AM UTC | The Strapi team developed an additional patch for the vulnerability by adding a configurable JWKS url. |
| 2023/01/19 03:08 PM UTC | Strapi and the security researcher both decided to delay the public disclosure of this vulnerability until **CVE-2023-22894** has been patched. |
| 2023/01/25 08:21 PM UTC | Strapi released version **4.6.0** that patches this vulnerability. |
| 2023/04/17 09:00 AM UTC | Released the full disclosure of the vulnerability. |

## CVE-2023-22894: Leaking Sensitive User Information by Filtering on Private Fields

### Summary of CVE-2023-22894 Vulnerability Details

- **CVE:** CVE-2023-22894
- **CVSS v3.1 Vector:** [AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator?vector=AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H&version=3.1)
- **Affected Versions:** >=3.2.1,<4.8.0
- **How to Patch:** Immediately **update** your Strapi to version **>4.8.0**! If you using Strapi **3.x.x** or below, [**IMMEDIATELY UPDATE TO A PATCHED 4.x.x VERSION!**](https://docs.strapi.io/dev-docs/update-version) Strapi versions 3.x.x reached its **end of life support on the December 31st 2022**, and would **not receive a patch** for this vulnerability!

### Description of CVE-2023-22894

### CVE-2023-22894 IoC’s

The exploitation of **CVE-2023-22894** is easily detectable, since the payload is within the GET parameters and are normally included in request logs. The following regex pattern will extract requests that are exploiting this vulnerability to leak user's email, password and password reset token columns.

```js
/(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)/
```

You can search log files for this IoC by using the following `grep` command.

```bash
grep -iE '(\[|%5B)\s*(email|password|reset_password_token|resetPasswordToken)\s*(\]|%5D)' $PATH_TO_LOG_FILE
```

If the above regex pattern matches any lines in your log files, take extra precaution to look out for multiple requests that include `password`, `reset_password_token` or `resetPasswordToken`. **This would indicate that an attacker has leaked the password hashes and reset tokens on your Strapi server and you need to immediately start an incident response!**

### CVE-2023-22894 Timeline

| Time | Event |
| ---- | ----- |
| 2023/01/03 01:26 PM UTC | Report of the vulnerability received by the Strapi security team as *Medium* severity since the first vector was only accessible by Strapi administrators. |
| 2023/01/03 07:03 PM UTC | Sent first response acknowledging the report and began testing reproduction. |
| 2023/01/18 08:05 AM UTC | The security researcher discovered and notified Strapi that **unauthenticated users could exploit this vulnerability** and escalated the severity from *Medium* to **Critical**. However, at the time it was believed that an attacker can exploit under certain conditions. |
| 2023/01/21 10:26 AM UTC | The security researcher discovered a method to exploit this vulnerability as an **unauthenticated user on all Strapi servers**. The security researcher also sent Strapi a POC that would achieve **Unauthenticated Remote Code Execution** on all Strapi <=4.5.5 servers by chaining **CVE-2023-22894** and **CVE-2023-22621** together. |
| 2023/02/23 02:31 PM UTC | The Strapi team developed a fix for this vulnerability and released a nightly build for testing the patch. |
| 2023/03/05 02:51 AM UTC | The security researcher confirmed Strapi's patch fixed this vulnerability. |
| 2023/03/15 03:39 PM UTC | Strapi released version **4.8.0** that patches this vulnerability. |
| 2023/04/17 09:00 AM UTC | Released the full disclosure of the vulnerability. |

### Chaining of CVE-2023-22621 and CVE-2023-22894 Together to Achieve Unauthenticated RCE

Thanks to the diligent work of the security researcher it was made apparent that it was possible to combine both CVE-2023-22621 and CVE-2023-22894 which combined allow for an unauthenticated RCE on all Strapi <=4.5.5 servers. By exploiting and hijacking a super admin account via the admin panel and using that account to modify the users-permissions template it would be possible to execute arbitrary code on the server.

Exploiting CVE-2023-22894

1. Search for any entry on a publicly accessible entry for a collection that was created or updated by a super administrator user.
2. Leak the email address for the super administrator user.
3. Perform the forgot my password action for the super administrator account.
4. Leak the reset password token for the super administrator user.
5. Set a new password for the super administrator account and grab the API token for the admin API.

Exploiting CVE-2023-22621

1. Set a crafted email template that executes arbitrary terminal commands when rendered for when API accounts register.
2. Enable sending emails on API account registration.
3. Register a new API account to trigger the RCE vulnerability.
4. Arbitrary code is then executed on the targeted server.

## Summary and a Thank You to the Security Researcher

We on the Strapi security team wanted to give a massive shout out to the security researcher GhostCcamm. Never in Strapi's history have we had a security researcher go above and beyond to help us improve the security of our product. We are very thankful for their work and dedication, the amount of detail they placed in their PoCs was simply outstanding and allowed us to quickly verify and patch the vulnerabilities. We simply cannot thank them enough for their work and for transparency; Strapi does not have a bug bounty program (for several reasons, largely because it tends to attract very mundane and invalid security reports) but in this case we did want to reward GhostCcamm for their work and did offer them a monetary reward.

For additional information about each of the vulnerabilities from the security researcher's perspective, please see their extremely detailed blog post, additionally below are their social links.

- Blog post for these vulnerabilities: https://www.ghostccamm.com/blog/multi_strapi_vulns/
- Twitter: https://twitter.com/GhostCcamm
- Website: https://www.ghostccamm.com
- GitHub: https://github.com/Ccamm

We cannot thank GhostCcamm enough and look forward to continuing to work with them in the future. Their patience and constant communication throughout the process was simply outstanding and we sincerely hope that others will follow your example.

## Commitment to Responsible Disclosure

We at Strapi do believe in responsible disclosure, in the case of these vulnerabilities we have worked with the security researcher to ensure that the vulnerabilities were patched before the full disclosure of the vulnerabilities. Once a vulnerability is patched, we added a notice to our release notes to inform users there was a security vulnerability but initially wanted to delay detailed disclosure for a few weeks to give time for users to upgrade before release of the full disclosure. As an additional step we did immediately notify our customers via several emails beforehand to ensure they were aware of the vulnerabilities and to upgrade their Strapi servers.

We do believe that delaying the detailed disclosure in this case was important to ensure that users had the time required to upgrade their Strapi servers before making the details of each vulnerability public and thus placing that information in the hands of bad actors. We also believe that the security researcher was very professional and responsible in their handling of the vulnerabilities and we are very thankful for their work in helping us to improve the security of Strapi.

We urge anyone who believes they have discovered a security vulnerability to assist us in responsibly disclosing the vulnerability to us by emailing security@strapi.io.

Thanks,

The Strapi Security Team

medium_Security Disclosure of Vulnerabilities.png

small_Security Disclosure of Vulnerabilities.png

thumbnail_Security Disclosure of Vulnerabilities.png

Security Disclosure of Vulnerabilities.png

Security Disclosure of Vulnerabilities: CVE-2023-22893, CVE-2023-22621, and CVE-2023-22894