PT-2025-23048 · Strapi · Strapi

Published 2025-05-27 · Updated 2025-06-24 · CVE-2024-52588

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Strapi versions prior to 4.25.2

Description The issue allows an attacker to input a local domain into the Webhooks URL field, leading to a server-side request forgery (SSRF). This enables the application to fetch itself, potentially allowing an attacker to brute-force through all 65535 ports to determine which ports are open if there is a real server running Strapi with multiple ports open.

Recommendations For Strapi versions prior to 4.25.2, update to version 4.25.2 to resolve the issue. As a temporary workaround, consider restricting access to the Webhooks URL field to minimize the risk of exploitation. Avoid using local domains such as localhost, 127.0.0.1, or 0.0.0.0 in the Webhooks URL field until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2024-52588

GHSA-V8WJ-F5C7-PVXF

Affected Products

Strapi

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/52xxx/CVE-2024-52588.json · Exploit
• https://github.com/strapi/strapi/security/advisories/GHSA-v8wj-f5c7-pvxf · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-52588 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v8wj-f5c7-pvxf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-52588 · Security Note
• https://github.com/strapi/strapi · Note
• https://twitter.com/CVEnew/status/1928022573608001891 · Twitter Post
• https://t.me/cvenotify/123955 · Telegram Post
• https://t.me/cvenotify/126575 · Telegram Post
• https://t.me/cvetracker/24881 · Telegram Post