PT-2023-26486 · Strapi · Strapi
Scgajge12
·
Published
2023-09-13
·
Updated
2023-09-21
·
CVE-2023-38507
CVSS v3.1
7.3
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
Name of the Vulnerable Software and Affected Versions
Strapi versions prior to 4.12.1
Description
The issue concerns Strapi, an open-source headless content management system. Prior to version 4.12.1, there is a rate limit on the login function of Strapi's admin screen, but it is possible to circumvent it. This increases the possibility of unauthorized login by login brute force attack. The vulnerability can be exploited by manipulating the request path, such as changing the case of the path or adding a trailing slash. For example, an attacker can use the
/admin/login endpoint and then modify it to /admin/Login or /admin/login/ to bypass the rate limit.Recommendations
For versions prior to 4.12.1, update to version 4.12.1 to fix the issue. As a temporary workaround, consider modifying the rate limiting mechanism to forcibly convert the request path to upper or lower case and remove any extra slashes, as suggested in the measures section of the OSV description. This can help prevent the bypass of the rate limit.
Exploit
Fix
Allocation of Resources Without Limits
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Strapi