Vulnerability · Published Jul 25, 2023 · Assigned by GitHub_M
CVE-2023-34235Leaking sensitive user information still possible by filtering on private with prefix fields
High 8.6
In plain English
A high-severity information exposure in strapi from strapi. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.1% (higher than 66% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
Strapi is an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if one is using the `t(number)` prefix. Knex query allows users to change the default prefix. For example, if someone changes the prefix to be the same as it was before or to another table they want to query, the query changes from `password` to `t1.password`. `password` is protected by filtering protections but `t1.password` is not protected. This can lead to filtering attacks on everything related to the object again, including admin passwords and reset-tokens. Version 4.10.8 fixes this issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| npm | @strapi/database | 4.10.8 | GHSA-9xg4-3qfm-9w8f |
| npm | @strapi/utils | 4.10.8 | GHSA-9xg4-3qfm-9w8f |
Affected products (as reported)
Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
- https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f x_refsource_CONFIRM
- https://github.com/strapi/strapi/releases/tag/v4.10.8 x_refsource_MISC