Information Exposure Affecting @strapi/strapi package, versions <4.10.8
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-STRAPISTRAPI-5805052
- published 26 Jul 2023
- disclosed 25 Jul 2023
- credit Marc Roig
Introduced: 25 Jul 2023
CVE-2023-34093 Open this link in a new tabHow to fix?
Upgrade @strapi/strapi to version 4.10.8 or higher.
Overview
@strapi/strapi is an updated version of the old 'strapi', which is a free and open-source headless CMS delivering your content anywhere you need.
Affected versions of this package are vulnerable to Information Exposure by developers, users, or plugins, all of who can make every attribute of a Content-Type public without knowing it. The privateAttributes getter is removed when content types are modified, which can result in any attribute becoming public.
NOTE: If a user mutates the content-type they will not be affected.
PoC
strapi.container.get('content-types').extend(contentTypeUID, (contentType) => {
const newCT = { ... contentType, attributes: { ...contentType.attributes, newAttr: {} } };
return newCT;
});
Copying a content-type causes the getter to be removed.