Strapi releases update addressing two bugs that lead to data exposure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2022-30617 +1 in the same advisory: …30618 | An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel An authenticated user with access to the Strapi admin panel can view private and sensitive data, such as email and password reset tokens, for other admin panel users that have a relationship (e.g., created by, updated by) with content accessible to the authenticated user. For example, a low-privileged “author” role account can view these details in the JSON response for an “editor” or “super admin” that has updated one of the author’s blog posts. There are also many other scenarios where such details from other users can leak in the JSON response, either through a direct or indirect relationship. Access to this information enables a user to compromise other users’ accounts by successfully invoking the password reset workflow. In a worst-case scenario, a low-privileged user could get access to a “super admin” account with full control over the Strapi instance, and could read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users. NVD description · AI analysis pending | 8.8 group max | 1% |
| — |
Full article455 words · extracted from therecord.media · click to collapse
Popular open source content management system (CMS) Strapi released patches addressing two vulnerabilities that would allow hackers to view private and sensitive data, such as email and password reset tokens. Strapi is known for its “headless” CMS, which means the front end and back end of the system are completely separate. Thousands of companies use the software, according to David Johansson, principal security consultant at Synopsys Software Integrity Group, which discovered the issues. While Strapi is less well-known than its competitors WordPress and Joomla, it is used by IBM, Walmart, NASA, Societe Generale and Delivery Hero among others. The vulnerabilities were discovered in November and Strapi initially patched CVE-2022-30617 that same month. But other issues were found, and another patch was issued for CVE-2022-30617 and CVE-2022-30618 on May 11. CVE-2022-30617 has a CVSS base score of 8.8 and CVE-2022-30618 has a score of 7.5. Johansson said Strapi has nearly 40,000 weekly downloads on NPM for its latest release and about 25,000 weekly downloads for its older version. His team found the vulnerabilities in the admin panel and said they could easily lead to account compromise. He was unsure of how many installations are currently vulnerable but considering the patch was only released in recent weeks, it is “reasonable to assume that not everyone has upgraded yet.” “Excessive data exposure is a very widespread weakness and listed as #3 in OWASP API Security Top 10 list. A malicious user that has access to the Strapi web-based UI (e.g., a content author) can use the vulnerabilities to compromise other accounts in the platform,” he explained. “In general, this means that an attacker could read and edit content belonging to other authors, and if the compromised user account has a different user role the attacker may be able to gain additional privileges.” According to Johansson, a worst case scenario would be a situation where a “Super Admin” account is targeted, leading to total compromise of the Strapi installation. That would allow an attacker to read, modify or delete any content and change or revoke permissions for all other users. “While the worst-case scenario is a possible result from both CVE-2022-30617 (primarily affecting v3) and CVE-2022-30618 (affecting both v3 and v4), in practice it is much less likely to occur with the latter (CVE-2022-30618) since it targets API users, who are less likely to have been configured with such powerful permissions,” he added.
No previous article
No new articles
Jonathan Greig
is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/strapi-releases-update-addressing-two-bugs-that-lead-to-data-exposure