Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
3 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
I can get access to user reset password tokens if I have the configure view permissions Details /content-manager/relations route does not remove private fields or ensure that they can't be selected PoC Install fresh strapi instance start up strapi and create an account create a new content-type give the content-type a relation with admin users and save go to Admin panel roles Author and then plugins. Enable for content-manager collection types the configure view In the collection time now only give them access to the collection you created for this. Create a new admin user account with the Author role Log out and request a password reset for the main admin user. Login on the newly created account go to the collection type you created for this test and click the create new entry button, click in the create new entry view on configure view. select the admin user relation we created click on resetPasswordToken Now go back to the create an entry view and when selection the…
Recommended action: Upgrade to 4.11.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Still able to leak private fields if using the t(number) prefix Details Knex query allows you to change there default prefix so if you change the prefix to the same as it was before or to an other table you want to query you query changes from password to t1.password password is protected by filtering protections but t1.password is not protected PoC 1 Create a contentType 2 add to its options "populateCreatorFields" 3 create 1 entity in your new content type 4 in settings enable the find route in settings for the content type you created for public 5 /api/(Your contenttype)?filters%5BupdatedBy%5D%5Bt1.password%5D%5B%24startsWith%5D=a%24 And now the api returns noting if you were to do /api/(Your contenttype)?filters%5BupdatedBy%5D%5Bt1.password%5D%5B%24startsWith%5D=%24 it would return your entity Impact You can do filtering attacks on everything related to the object again including admin passwords and reset-tokens.
Recommended action: Upgrade to 4.10.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. Details When dealing with content-types inside a Strapi instance, we can extend those using the appropriate container: The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the privateAttributes getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). PoC Extend any content type on runtime (like in the bootstrap functions) and do a copy of the content-type object. This will have as effect to remove the getter and as we rely on it in sanitization, every attributes will be considered as public. Impact Everyone can be impacted. Depending on how people are…
Recommended action: Upgrade to 4.10.8 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.