CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin

What is CVE-2023-22621?

CVE-2023-22621 is a critical code injection vulnerability in n/a, published on 19 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.

Weakness: CWE-74

Which versions are affected by CVE-2023-22621?

4 open source packages ship an affected version, including @strapi/plugin-email and @strapi/plugin-users-permissions. It affects 1 product.

Products include Strapi Strapi.

How do I fix CVE-2023-22621?

Upgrade @strapi/plugin-email to 4.5.6 or later.

Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.

Is CVE-2023-22621 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-22621 exists.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Other vulnerabilities in n/a

• CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information Exploited High 7.2
• CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi Critical 9.8
• CVE-2020-27664 Authorization bypass in Strapi Critical 9.8
• CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token Critical 9.8
• CVE-2026-22599 Strapi Vulnerable to SQL Injection in Content Type Builder Critical 9.3

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-2h87-4q2w-v4hf.