Horizon Alert
Summary of the vulnerability and why it matters
This vulnerability in Strapi, an open-source content management system, allows an unauthenticated attacker to potentially take over an administrative account. The system improperly handles query parameters when filtering content, enabling an attacker to exploit this to extract sensitive information like password reset tokens. This issue is critical because it can lead to a complete compromise of administrative access without any prior authentication.
- Attackers can bypass authentication.
- Full administrative account takeover is possible.
- Affects publicly accessible content APIs.
Attack Path
How an attacker could exploit the issue
An unauthenticated attacker can exploit this flaw by manipulating query parameters on publicly accessible Strapi content APIs. They can craft specific filter requests that traverse relational fields, effectively using the response count as a boolean oracle to guess private fields in the admin user table. Successfully guessing the password reset token allows complete administrative account takeover.
- Public API access required.
- Filter parameter manipulation is the vector.
- Target admin user table fields.
Live Threat
Current exploitation, exposure, and threat context
Attackers will likely target this vulnerability due to its critical severity and the potential for unauthenticated full administrative account takeover. The Strapi CMS is often deployed with publicly accessible APIs, which this vulnerability directly impacts, making it an attractive target for exploitation.
- Publicly accessible APIs.
- Unauthenticated account takeover.
- No observed exploitation signals.
Priority actions
Operational Fix
Recommended remediation, mitigation, and detection steps
Prioritize patching Strapi instances to version 5.37.0 or later to address the critical vulnerability allowing admin account takeover. If immediate patching is not feasible, implement strict WAF rules to block suspicious `where` query parameters targeting relational fields and monitor logs for any attempts to exploit this flaw.
- Apply patch to version 5.37.0.
- Block exploit queries with WAF.
- Monitor for token extraction attempts.
