CVE-2022-32114: XSS
DISPUTED An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.
Other sources
An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. After an authenticated attacker uploads a file containing a malicious URL, a victim copies and pastes the malicious URL into a new tab to receive the XSS payload.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Restrict Strapi Media Library "Add New Assets" uploads to image/video/audio only by disallowing PDF files (to prevent XSS via crafted PDF uploads described for v4.1.12).
Strapi 4.1.12 (Add New Assets / Media upload) Allowed file types (disable PDF uploads) = Disable PDF - Compensating control
If public exposure of uploaded files is configured (public assets folder), prevent external access to uploaded files or ensure only non-executable, permitted content is served publicly, since the issue notes that files in a public assets folder are accessible to the outside world.
Event History
Frequently Asked Questions
What is CVE-2022-32114?
CVE-2022-32114 is an unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 that allows attackers to conduct XSS attacks via a crafted PDF file.
What is the severity of CVE-2022-32114?
The severity of CVE-2022-32114 is rated as high with a CVSS score of 8.8.
How does CVE-2022-32114 affect Strapi?
CVE-2022-32114 affects Strapi version 4.1.12.
How can an attacker exploit CVE-2022-32114?
An attacker can exploit CVE-2022-32114 by uploading a crafted PDF file through the Add New Assets function and conduct XSS attacks.
Are there any fixes or patches available for CVE-2022-32114?
Strapi has not released any specific fixes or patches for CVE-2022-32114. It is recommended to follow secure coding practices and ensure user input is properly validated and sanitized.