CVE-2023-34235: Leaking sensitive user information still possible by filtering on private with prefix fields
First published: Tue Jul 25 2023(Updated: )
### Summary Still able to leak private fields if using the t(number) prefix ### Details Knex query allows you to change there default prefix ```SqliteError: select distinct `t0`.* from `pages` as `t0` left join `admin_users` as `t1` on `t0`.`updated_by_id` = `t1`.`id` where (`t1`.`password` = 1)``` so if you change the prefix to the same as it was before or to an other table you want to query you query changes from password to t1.password password is protected by filtering protections but t1.password is not protected ### PoC 1 Create a contentType 2 add to its options "populateCreatorFields" 3 create 1 entity in your new content type 4 in settings enable the find route in settings for the content type you created for public 5 /api/(Your contenttype)?filters%5BupdatedBy%5D%5Bt1.password%5D%5B%24startsWith%5D=a%24 And now the api returns noting if you were to do /api/(Your contenttype)?filters%5BupdatedBy%5D%5Bt1.password%5D%5B%24startsWith%5D=%24 it would return your entity ### Impact You can do filtering attacks on everything related to the object again including admin passwords and reset-tokens.
Credit: security-advisories@github.com security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| npm/@strapi/utils | <=4.10.7 | 4.10.8 |
| npm/@strapi/database | <=4.10.7 | 4.10.8 |
| Strapi Strapi | <4.10.8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is CVE-2023-34235?
CVE-2023-34235 is a vulnerability in Strapi, an open-source headless content management system. Prior to version 4.10.8, it is possible to leak private fields if using the `t(number)` prefix in Knex queries.
What is the severity of CVE-2023-34235?
CVE-2023-34235 has a severity rating of 8.6, which is classified as high.
Which software versions are affected by CVE-2023-34235?
Versions up to and including 4.10.7 of the @strapi/utils and @strapi/database packages, as well as versions up to and excluding 4.10.8 of Strapi itself, are affected by CVE-2023-34235.
How can I fix CVE-2023-34235?
To fix CVE-2023-34235, update your Strapi installation to version 4.10.8 or later, and make sure to also update the @strapi/utils and @strapi/database packages to version 4.10.8.
Where can I find more information about CVE-2023-34235?
For more information about CVE-2023-34235, you can refer to the following references: [GitHub Security Advisory](https://github.com/strapi/strapi/security/advisories/GHSA-9xg4-3qfm-9w8f) and [NVD CVE entry](https://nvd.nist.gov/vuln/detail/CVE-2023-34235).
- collector/github-advisory-latest
- alias/GHSA-9xg4-3qfm-9w8f
- alias/CVE-2023-34235
- collector/github-advisory
- collector/nvd-latest
- collector/nvd-index
- collector/nvd-cve
- agent/references
- agent/weakness
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/nvd-api
- agent/software-canonical-lookup-request
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/event
- agent/trending
- agent/tags
- agent/source
- package-manager/npm
- vendor/strapi
- canonical/strapi strapi