Authorization Bypass Through User-Controlled Key Affecting @strapi/plugin-content-manager package, versions <4.19.1


Severity

Recommended
0.0
low
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.04% (10th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-STRAPIPLUGINCONTENTMANAGER-7251657
  • published 13 Jun 2024
  • disclosed 12 Jun 2024
  • credit Felix Ortiz

How to fix?

Upgrade @strapi/plugin-content-manager to version 4.19.1 or higher.

Overview

@strapi/plugin-content-manager is an A powerful UI to easily manage your data.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key due to improper access control mechanisms in the Admin Panel. An attacker can view unauthorized data by exploiting the relations between collections.

PoC

  1. Sign in as Admin. Navigate to content creation.

  2. Select a collection and verify you have items you created there. And that they have associations to other protected collections.

  3. Verify role permissions for your collections are set to CRUD if user created.

  4. Log out and sign in as a unrelated Author.

  5. Navigate to content management and verify you see collections built by admin but empty for you (as expected)

  6. Create a new item as an Author and see the card appear with attributes to fill out.

  7. Use the form pull down for the associations.

  8. Notice that protected collection items from Admin appear in drop down. These should be hidden

References

CVSS Scores

version 3.1
Expand this section

Snyk

Recommended
2.3 low
  • Attack Vector (AV)
    Adjacent
  • Attack Complexity (AC)
    High
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    Required
  • Scope (S)
    Unchanged
  • Confidentiality (C)
    Low
  • Integrity (I)
    None
  • Availability (A)
    None