PT-2023-24759 · Strapi · Strapi

Boegie19 · Publicado 2023-07-25 · Atualizado 2025-11-26 · CVE-2023-34235

Positive Technologies (AI Summary)

CVSS v3.1

8.6

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.10.8

Description The issue allows for the leakage of private fields when using the t(number) prefix. This is possible because the Knex query allows users to change the default prefix. For example, changing the prefix to match another table can alter the query from password to t1.password, bypassing filtering protections that normally protect password. This can lead to filtering attacks on sensitive information, including admin passwords and reset tokens.

Recommendations For versions prior to 4.10.8, update to version 4.10.8 to resolve the issue. As a temporary workaround, consider avoiding the use of the t(number) prefix in queries until the update can be applied. Restrict access to sensitive fields and tables to minimize the risk of exploitation. Avoid using the password field in queries with altered prefixes until the issue is resolved.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2023-34235

GHSA-9XG4-3QFM-9W8F

Produtos afetados

Strapi

Referências · 8

• 🔥 https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34235.json · Exploit
• https://github.com/strapi/strapi · Nota
• https://github.com/strapi/strapi/releases/tag/v4.10.8 · Nota
• https://twitter.com/dailycve/status/1993830420946014691 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-9xg4-3qfm-9w8f · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2023-34235 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2023-34235 · Aviso do Fabricante