Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS
    Cognito login provider is used for authentication. A remote attacker could forge an ID token that is
    signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS
    Cognito for authentication. (CVE-2023-22893)

Strapi is a popular open-source headless CMS built with Node.js. Strapi versions after 3.2.0 and before 4.6.0 suffer from a lack of validation of JWT tokens sent through the AWS Cognito authentication provider during the OAuth flow.

By forging a custom JWT token with any signature, a remote and unauthenticated attacker can impersonate any user who use AWS Cognito to authenticate against the target application.

ID	Name	Product	Family	Type	Severity
410677	SCA: security update for @strapi/plugin-users-permissions (GHSA-583x-23h9-f5w7)	Tenable Cloud Security	SCA Checks	Local	high
410677	SCA: security update for @strapi/plugin-users-permissions (GHSA-583x-23h9-f5w7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
114041	Strapi Cognito Provider Authentication Bypass	Web App Scanning	Component Vulnerability	Check Based	high

Detections

Analytics

CVE-2023-22893

high

Tenable Plugins

high

high

high