CVE-2023-22894

Vulnerability

Overview

CVE-2023-22894 is an information disclosure vulnerability affecting Strapi versions through 4.5.5. The vulnerability arises because the API query filtering mechanism fails to restrict access to private fields (e.g., passwordHash, resetPasswordToken). An attacker with valid admin panel access can craft filter queries against user endpoints to enumerate and infer values for these sensitive columns based on API response differences, leaking confidential user data [1] [4].

Exploitation

Prerequisites and Method

Exploitation requires an authenticated session with the Strapi admin panel. If the attacker holds a super admin role, they can directly filter on any column, including those containing password hashes and reset tokens for all users [2] [4]. For lower-privileged admin roles (e.g., with access only to usernames and emails of API users), the attacker can still leverage the filter to extract sensitive information of API users by iterating through valid values and observing the response, thereby inferring data from private fields [4]. No additional privileges are needed beyond the initial admin access.

Potential

Impact

Successful exploitation enables the attacker to obtain highly sensitive information: password hashes (potentially crackable offline) and password reset tokens for all users (if super admin) or API user population (if lower role). With a reset token, the attacker could hijack user accounts without knowing the current password. This can be chained with other vulnerabilities like CVE-2023-22621 (SSTI to RCE) to escalate from information disclosure to full remote code execution as an unauthenticated user on versions <=4.5.5 [1] [2].

Mitigation

Status

Strapi patched this vulnerability in version 4.5.6. Users are strongly advised to upgrade to at least 4.5.6, and preferably to a later stable release (e.g., 4.8.0 or newer) where additional security fixes are included [2] [3]. There is no workaround short of upgrading. Versions 3.x.x are end-of-life and no longer receive security updates, so migration to a supported 4.x.x release is critical [2].