CVE-2022-30618

Vulnerability

In Strapi, an authenticated user with access to the admin panel can leak private and sensitive data (such as email addresses and password reset tokens) of API users (from:users-permissions). This occurs when content types accessible to the authenticated user contain direct or indirect relationships to API users [1][3]. Affected versions include Strapi releases prior to the fix for this CVE-2022-30618. The leak happens in JSON responses within the admin panel.

Exploitation

An attacker must have a valid account with at least some admin panel access (low-privileged role such as "author") [1][3]. No user interaction from the target API user is required. The attacker simply navigates to content items that have relationships to API user records; the sensitive fields are automatically included in the JSON response returned by the admin panel. If the password reset API endpoints are enabled, the attacker can use the leaked reset tokens to compromise API user accounts [3].

Impact

Successful exploitation allows the attacker to obtain email addresses and password reset tokens of API users. With these tokens, the attacker can reset the password of those API users and gain full control over their accounts [1][3]. In a worst-case scenario, a low-privileged attacker could take over a high-privileged API account, enabling read/write access to any data, and potentially revoke privileges for all other users, blocking access to both the admin panel and API [1][3].

Mitigation

The Strapi project has not yet officially disclosed a fixed version in the available references, but users should monitor the Strapi GitHub repository [2] and the Strapi advisory page for updates. As a workaround, administrators can review and restrict relationships between content types and API users, and disable password reset API endpoints if not strictly required [1][3].