CVE-2021-46440

Vulnerability

The DOCUMENTATION plugin component in Strapi stores passwords in a recoverable format (base64-encoded) within cookies. This affects Strapi versions before 3.6.9 and 4.x before 4.1.5 [1]. The plugin uses a cookie to persist authentication credentials, making them retrievable by an attacker who can intercept the victim's HTTP request.

Exploitation

An attacker must be able to access a victim's HTTP request, for example through a man-in-the-middle position or by monitoring network traffic. The attacker obtains the victim's cookie, performs a base64 decode, and extracts the cleartext password [1]. No additional authentication or user interaction beyond the victim's normal use is required.

Impact

Successful exploitation reveals the victim's cleartext password. With this password, the attacker can access the API documentation, which may expose further attack surfaces and enable additional API attacks [1]. The primary impact is information disclosure of credentials and subsequent unauthorized access to API documentation.

Mitigation

The vulnerability is fixed in Strapi versions 3.6.9 and 4.1.5 [1]. The fix was implemented in pull request #12246 [4]. Users should upgrade to these versions or later. No workarounds are documented in the available references.