PT-2024-27764 · Strapi · Strapi

Published 2024-06-20 · Updated 2024-10-04 · CVE-2024-37818

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi version 4.24.4

Description The issue allows attackers to scan for open ports or access sensitive information via a crafted GET request to the "/strapi.io/ next/image" component. This is a Server-Side Request Forgery (SSRF) vulnerability. The Strapi Development Community argues that this issue is not valid, contending that the flaw only pertains to the strapi.io website and does not pose any real SSRF risk to applications using the Strapi library.

Recommendations For Strapi version 4.24.4, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-37818

GHSA-P9FF-J98V-P435

Affected Products

Strapi

References · 10

• 🔥 https://medium.com/%40barkadevaibhav491/server-side-request-forgery-in-strapi-e02d5fe218ab · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-37818 · Security Note
• https://osv.dev/vulnerability/CVE-2024-37818 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9ff-j98v-p435 · Vendor Advisory
• https://github.com/strapi/strapi · Note
• https://strapi.io · Note
• https://t.me/cvenotify/83913 · Telegram Post
• https://t.me/cvenotify/97086 · Telegram Post
• https://twitter.com/CVEnew/status/1803863183355973831 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1803964912332374105 · Twitter Post