PT-2023-24759 · Strapi · Strapi

Boegie19 · Published 2023-07-25 · Updated 2025-11-26 · CVE-2023-34235

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.10.8

Description The issue allows for the leakage of private fields when using the t(number) prefix. This is possible because the Knex query allows users to change the default prefix. For example, changing the prefix to match another table can alter the query from password to t1.password, bypassing filtering protections that normally protect password. This can lead to filtering attacks on sensitive information, including admin passwords and reset tokens.

Recommendations For versions prior to 4.10.8, update to version 4.10.8 to resolve the issue. As a temporary workaround, consider avoiding the use of the t(number) prefix in queries until the update can be applied. Restrict access to sensitive fields and tables to minimize the risk of exploitation. Avoid using the password field in queries with altered prefixes until the issue is resolved.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2023-34235

GHSA-9XG4-3QFM-9W8F

Affected Products

Strapi

References · 8

• 🔥 https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/34xxx/CVE-2023-34235.json · Exploit
• https://osv.dev/vulnerability/GHSA-9xg4-3qfm-9w8f · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-34235 · Security Note
• https://osv.dev/vulnerability/CVE-2023-34235 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://github.com/strapi/strapi/releases/tag/v4.10.8 · Note
• https://twitter.com/dailycve/status/1993830420946014691 · Twitter Post