PT-2023-26892 · Strapi · Strapi

Dogusdeniz · Published 2023-11-03 · Updated 2023-11-14 · CVE-2023-39345

Positive Technologies (AI Summary)

CVSS v3.1

7.6

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions strapi versions prior to 4.13.1

Description strapi is an open-source headless CMS. The issue arises from the improper restriction of write access to fields marked as private in the user registration endpoint. This allows malicious users to modify their user records. There are no known workarounds for this issue.

Recommendations For versions prior to 4.13.1, upgrade to version 4.13.1 to address the issue. As a temporary workaround, consider implementing a custom sanitize function to filter out private fields, similar to the provided code snippet, until a patch is available. Restrict access to the user registration endpoint to minimize the risk of exploitation. Avoid using the private fields in the affected API endpoint until the issue is resolved.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2023-39345

GHSA-GC7P-J5XM-XXH2

Affected Products

Strapi

References · 8

• 🔥 https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39345.json · Exploit
• https://osv.dev/vulnerability/GHSA-gc7p-j5xm-xxh2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-39345 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39345 · Security Note
• https://github.com/strapi/strapi · Note
• https://t.me/cibsecurity/73632 · Telegram Post
• https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023 · Note