CVE-2022-32114

Vulnerability

Overview

The CVE-2022-32114 describes an unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12, where an attacker can upload a crafted PDF file containing JavaScript to conduct a cross-site scripting (XSS) attack. The official description notes that this behavior aligns with the project's documented design: users with the Media Library "Create (upload)" permission are intended to be able to upload PDF files that may contain JavaScript, and all files in the public assets folder are accessible externally unless the filename begins with a dot [1][3].

Exploitation

Context

Exploitation requires that an administrator has not configured the Media Library to restrict uploads to only image, video, and audio file types. By default, Strapi allows uploading PDF files, and the attacker must have a valid account with at least the "Create (upload)" permission in the Media Library role [2]. Once uploaded, the malicious PDF is stored in the public assets folder and can be accessed by anyone who knows the file path.

Impact

An attacker who successfully uploads a crafted PDF can trigger arbitrary JavaScript execution in the context of a user who views or downloads the file, leading to potential data theft, session hijacking, or other client-side attacks. The impact is limited to users who interact with the malicious file.

Mitigation

Status

Strapi administrators can mitigate this by configuring the Media Library global settings to allow only image, video, and audio uploads, effectively blocking PDF files. This is a documented configuration option, not a code-level patch [1]. No formal security patch was issued for this behavior, as it is considered by the project to be a matter of configuration rather than a vulnerability in the software itself [3].