Unauthorized Access to Private Fields in User Registration API in strapi

Vulnerability

Description Strapi versions prior to 4.13.1 contain a vulnerability in the user registration endpoint that does not properly restrict write access to fields marked as private in the user content-type. Private fields, intended to be hidden from users, were not filtered out during registration, allowing malicious actors to include values for these fields in registration requests [1][2][4].

Exploitation

An attacker can exploit this by sending a POST request to the registration API with additional data intended for private fields. No special privileges are required; the attacker only needs to know the field names that are marked as private. The vulnerability exists because the sanitization logic did not exclude private fields, as demonstrated by a security researcher who provided a temporary workaround using _.omitBy to filter them out [4].

Impact

Successful exploitation allows an unauthorized user to modify their own user record, potentially setting values for private fields such as roles, permissions, or other sensitive attributes. This could lead to privilege escalation or unauthorized access to restricted functionality, depending on the specific private fields defined in the user content-type [1][2].

Mitigation

The vulnerability has been addressed in Strapi version 4.13.1, with further hotfixes in 4.13.5. Users are advised to upgrade immediately. There are no known workarounds for this issue, as the existing sanitization functions did not properly handle private fields [1][2].