PT-2022-12709 · Strapi · Strapi

Published 2022-05-03 · Updated 2022-07-12 · CVE-2021-46440

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 3.6.9 Strapi versions 4.x prior to 4.1.5

Description The issue arises from storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi. This allows an attacker to access a victim's HTTP request, obtain the victim's cookie, perform a base64 decode on the cookie, and obtain a cleartext password. This can lead to the attacker getting API documentation for further API attacks.

Recommendations For Strapi versions prior to 3.6.9, update to version 3.6.9 or later. For Strapi versions 4.x prior to 4.1.5, update to version 4.1.5 or later. As a temporary workaround, consider restricting access to the DOCUMENTATION plugin component until a patch is available.

Exploit

Fix

Insecure Storage of Sensitive Information

Insufficiently Protected Credentials

Weakness Enumeration

CWE-922

CWE-522

Related Identifiers

CVE-2021-46440

GHSA-85VG-GRR5-PW42

Affected Products

Strapi

References · 9

• 🔥 http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html · Exploit
• https://github.com/strapi/strapi/pull/12246 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-46440 · Security Note
• https://strapi.io · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-85vg-grr5-pw42 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-46440 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://t.me/cibsecurity/41837 · Telegram Post
• https://hub.docker.com/r/strapi/strapi · Note