CVE-2024-37818 Strapi Server-Side Request Forgery (SSRF)
Attackers can perform Server-Side Request Forgery via the image component to scan ports or access sensitive information, though the vendor disputes the validity of this issue.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-37818?
CVE-2024-37818 is a high-severity server-side request forgery vulnerability in n/a, published on 20 Jun 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request. NOTE: The Strapi Development Community argues that this issue is not valid. They contend that "the strapi/admin was wrongly attributed a flaw that only pertains to the strapi.io website, and which, at the end of the day, does not pose any real SSRF risk to applications that make use of the Strapi library."
Weakness: CWE-918
Which versions are affected by CVE-2024-37818?
2 open source packages ship an affected version, including @strapi/strapi. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
@strapi/strapi npm | All versions | None |
@strapi/strapi npm | All versions | None |
Products include Strapi Strapi.
How do I fix CVE-2024-37818?
No fix has been published for CVE-2024-37818 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2024-37818 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-37818 exists.
Other vulnerabilities in n/a
- CVE-2023-22894 Strapi Cleartext Storage of Sensitive Information
- CVE-2023-22621 Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin
- CVE-2022-27263 Unrestricted Upload of File with Dangerous Type in Strapi
- CVE-2020-27664 Authorization bypass in Strapi
- CVE-2019-18818 Strapi allows unauthenticated attacker to reset admin password without valid reset token
Sources
Also known as GHSA-p9ff-j98v-p435.