CVE-2020-13961

Root

Cause Strapi versions prior to 3.0.2 store email templates in a global variable without proper sanitization [1]. This allows an authenticated remote attacker to bypass security restrictions by sending a specially crafted request to update the email templates used for password reset and account confirmation processes [1][3].

Exploitation

An attacker with remote authenticated access can craft a request that targets the unsanitized global template variable. No special privileges beyond regular authentication are required; the vulnerability lies in the lack of input validation when templates are stored in the global scope [1]. The attack modifies both password reset and account confirmation email templates.

Impact

By altering these email templates, an attacker can inject malicious content into emails sent by the Strapi application. This could lead to phishing attacks, credential theft, or account takeover if users are tricked into following malicious links in the modified emails [1]. The severity is elevated because the attacker can control the content of sensitive transactional emails.

Mitigation

The vulnerability is fixed in Strapi version 3.0.2 [3]. Users should upgrade to this version or later immediately. No workarounds have been documented, and the fix likely involves proper sanitization of template inputs before storing them in the global variable.