CVE-2023-22894

Overview

This vulnerability is an information disclosure flaw arising from improper access control in Strapi's admin panel query filtering mechanism. The root cause lies in the ability to filter user data by columns containing sensitive information without adequate validation or restriction. The affected component is the Strapi admin panel's user query API, which processes filter parameters allowing unauthorized inference of protected user attributes.

Vulnerability Description

Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Impact

An attacker with access to the Strapi admin panel can leverage this vulnerability to enumerate sensitive user information. Super admin users can retrieve password hashes and reset tokens for all users, facilitating credential compromise. Admin users with restricted permissions can access usernames and emails of API users with lower roles, enabling targeted phishing or further attacks. This leads to significant data breaches and potential lateral movement within affected environments.

Solution

Upgrade Strapi to version 4.5.6 or later, where this vulnerability is addressed as documented in the Strapi security disclosure (https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve). Review the official GitHub release notes at https://github.com/strapi/strapi/releases for patch details. No specific workarounds are provided; applying the vendor patch is required to remediate the issue.

Affected Products (1)

	Vendor	Product	Version	CPE
S	Strapi	Strapi	All	cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*

GitHub PoCs (2)

Attack Vectors ML

MITRE ATT&CK Techniques (0)

CAPEC Attack Patterns ML

Red Team Playbook

Detection & Response Rules

No detection or response rules found for this CVE.

No news articles found for this CVE.

References (5)