CVE-2023-34093 Strapi allows actors to make all attributes on a content-type public without noticing it
Strapi developers or plugins can inadvertently expose private attributes, leading to sensitive data leaks and potential account takeover.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-34093?
CVE-2023-34093 is a medium-severity vulnerability in strapi, published on 25 Jul 2023. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Strapi is an open-source headless content management system. Prior to version 4.10.8, anyone (Strapi developers, users, plugins) can make every attribute of a Content-Type public without knowing it. The vulnerability only affects the handling of content types by Strapi, not the actual content types themselves. Users can use plugins or modify their own content types without realizing that the `privateAttributes` getter is being removed, which can result in any attribute becoming public. This can lead to sensitive information being exposed or the entire system being taken control of by an attacker(having access to password hashes). Anyone can be impacted, depending on how people are using/extending content-types. If the users are mutating the content-type, they will not be affected. Version 4.10.8 contains a patch for this issue.
Weakness: CWE-200
Which versions are affected by CVE-2023-34093?
6 open source packages ship an affected version, including @strapi/database, @strapi/strapi and @strapi/utils. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@strapi/database npm | All versions | 4.10.8 |
@strapi/database npm | All versions | 4.10.8 |
@strapi/strapi npm | All versions | 4.10.8 |
@strapi/strapi npm | All versions | 4.10.8 |
@strapi/utils npm | All versions | 4.10.8 |
@strapi/utils npm | All versions | 4.10.8 |
Products include Strapi Strapi.
How do I fix CVE-2023-34093?
Upgrade @strapi/database to 4.10.8 or later.
Is CVE-2023-34093 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-34093 exists.
Other vulnerabilities in strapi
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Sources
Also known as GHSA-chmr-rg2f-9jmf.