GHSA-4vm8-j95f-j6v5
Strapi 4.1.12 Cross-site Scripting via crafted file
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | @strapi/strapi | <= 4.1.12 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2022-32114
- https://docs.strapi.io/dev-docs/configurations/public-assets
- https://docs.strapi.io/user-docs/users-roles-permissions/configuring-administrator-roles
- https://github.com/bypazs/strapi
- https://github.com/strapi/strapi
- https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/content-type-builder/admin/src/components/Allow…
- https://github.com/strapi/strapi/blob/d9277d616b4478a3839e79e47330a4aaf167a2f1/packages/core/upload/admin/src/components/MediaLibraryInput/i…
- https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4e