Strapi Improper Rate Limiting vulnerability

Vulnerability

CVE-2023-38507 describes an improper rate-limiting vulnerability in Strapi, an open-source headless CMS, prior to version 4.12.1. The admin login endpoint /admin/auth/login enforces a rate limit, but an attacker can bypass it by manipulating the request path—for example, by changing the case of characters (e.g., /admin/Login) or appending a trailing slash (/admin/auth/login/). This allows an unlimited number of login attempts [1][3].

Exploitation

The vulnerability can be exploited without authentication by sending repeated login requests to the admin endpoint. A proof-of-concept (PoC) provided in the advisory demonstrates sending 30 incorrect logins, which triggers the rate limit (HTTP 429). However, by simply altering the path to a case-variated form (e.g., /admin/Login) or adding a trailing slash, the rate limit is circumvented, and subsequent login attempts succeed (HTTP 200) [3]. The attack only requires network access to the Strapi admin interface and knowledge of a valid email address.

Impact

Successful exploitation enables brute-force password guessing against the admin account. If the attacker guesses the correct password, they gain unauthorized access to the Strapi admin panel, potentially leading to full compromise of the CMS, including content manipulation, user account control, and further server-side attacks [2].

Mitigation

The issue is fixed in Strapi version 4.12.1 [4]. Users are strongly advised to upgrade immediately. No workarounds are documented; restricting network access to the admin panel can reduce exposure but does not fix the rate-limit bypass itself. The vulnerability appears on public exploit repositories, increasing the urgency for patching.