Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details
    by exploiting the query filter. The attacker can filter users by columns that contain sensitive
    information and infer a value from API responses. If the attacker has super admin access, then this can be
    exploited to discover the password hash and password reset token of all users. If the attacker has admin
    panel access to an account with permission to access the username and email of API users with a lower
    privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for
    all API users but not other admin accounts. (CVE-2023-22894)

Strapi is a popular open-source headless Content Management System (CMS) written in Node.js. Strapi versions before 4.8.0 suffer from an information disclosure vulnerability through collections private fields. By manipulating public collections query filters, a remote and unauthenticated attacker can infer sensitive information like encrypted password or password reset tokens by analyzing response discrepancies. Upon successful exploitation, the attacker can gain administrative access to the Strapi administration panel.

ID	Name	Product	Family	Severity
416435	SCA: security update for @strapi/strapi (GHSA-jjqf-j4w7-92w8)	Tenable Cloud Security	SCA Checks	medium
416435	SCA: security update for @strapi/strapi (GHSA-jjqf-j4w7-92w8)	Tenable Self-Hosted Container Security	SCA Checks	medium
114108	Strapi < 4.8.0 Private Fields Sensitive Information Disclosure	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2023-22894

medium

Tenable Plugins

medium

medium

medium