Critical, CVSS 10.0npmAmendedPublished
Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
CVE-2023-22621 · GHSA-2h87-4q2w-v4hf
- Affected
- npm @strapi/plugin-email < 4.5.6
- Fixed in
- 4.5.6· Vendor fix available
- Issue
- Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. Details Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution. IoC Using just the request log files, the only IoC to search for is a PUT request to URL path /users-permissions/email-templates. This IoC only indicates that a Strapi email template was modified on your server and by itself does not indicate if your Strapi server has been compromised. If this IoC is detected, you will need to manually review your email templates on your Strapi server and backups of your database to see if any of the templates contain a lodash template delimiter…
Recommended action: Upgrade to 4.5.6 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.