Published: 19/04/2023 Updated: 01/05/2023

CVSS v3 Base Score: 7.2 | Impact Score: 5.9 | Exploitability Score: 1.2

VMScore: 0

Strapi up to and including 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.

Vulnerable Product	Search on Vulmon	Subscribe to Product
strapi strapi

CVE-2023-22621: SSTI to RCE by Exploiting Email Templates affecting Strapi Versions <=4.5.5

CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting Email Templates affecting Strapi Versions <=455 The function sendTemplatedEmail renders email templates into HTML content using the lodash template engine that evaluates JavaScript code within templates ref: twittercom/rootxharsh/status/1268181937127997446?lang=en 'use strict'; const _ =

CVE-2023-22894

Unauthenticated Strapi Exploit: CVE-2023-22894 This repository contains a proof of concept (PoC) exploit for CVE-2023-22894, which allows unauthenticated users to leak sensitive information and hijack Strapi administrator accounts by exploiting Strapi's filtering functionality on private fields Overview This exploit targets Strapi versions <=471 and demonstrates

Patch-package patches for TID2212

Misc Security patches via patch-package for Strapi vulnerabilities Description This repository contains patch files for the following CVEs: CVE-2023-22621 These are manual patches for the vulnerabilities that are not yet patched in the latest version of Strapi or are for older unmaintained versions of Strapi For more detailed information please see the relevant READMEmd fil

CWE-74 https://www.ghostccamm.com/blog/multi_strapi_vulns/https://github.com/strapi/strapi/releases https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve https://nvd.nist.gov https://github.com/sofianeelhor/CVE-2023-22621-POC

CVE-2023-22621

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect