CVE-2023-22894: Strapi Information Disclosure Vulnerability

CVE-2023-22894 Overview

CVE-2023-22894 is an Information Disclosure vulnerability affecting Strapi through version 4.5.5. This vulnerability allows attackers with admin panel access to discover sensitive user details by exploiting the query filter mechanism. The attacker can filter users by columns that contain sensitive information and infer values from API responses.

The impact varies based on the attacker's access level. With super admin access, attackers can discover password hashes and password reset tokens for all users. With lower-privileged admin panel access (permissions to view usernames and emails of API users), attackers can discover sensitive information for all API users, though not other admin accounts.

Critical Impact

Attackers with admin panel access can extract password hashes and password reset tokens through query filter manipulation, potentially leading to full account compromise across the Strapi deployment.

Affected Products

• Strapi through version 4.5.5
• All Strapi installations with admin panel access enabled
• Systems where users have varying privilege levels (Super Admin, Editor, Author)

Discovery Timeline

• 2023-04-19 - CVE-2023-22894 published to NVD
• 2025-11-07 - Last updated in NVD database

Technical Details for CVE-2023-22894

Vulnerability Analysis

This vulnerability is classified under CWE-312 (Cleartext Storage of Sensitive Information). The core issue lies in Strapi's query filter implementation, which does not properly restrict filtering operations on sensitive data columns. When an authenticated admin user sends API requests with specific filter parameters, the system's response behavior reveals information about the data being queried.

The attack leverages boolean-based inference techniques. By constructing queries that filter on sensitive columns such as password hashes or reset tokens, an attacker can systematically extract these values character by character based on whether matching records are returned. This is particularly dangerous because it requires only legitimate admin credentials to execute, making it difficult to detect through traditional authentication monitoring.

Root Cause

The root cause stems from insufficient access control validation in the query filter functionality. Strapi's API allows filtering on database columns that contain sensitive information without verifying whether the requesting user should have access to those specific fields. The system processes filter requests against sensitive columns like password, resetPasswordToken, and similar fields, allowing attackers to infer their values through response analysis.

Attack Vector

The vulnerability is exploited over the network by authenticated users with admin panel access. The attack requires:

1. Valid admin panel credentials (any privilege level with user data access)
2. Knowledge of Strapi's API query filter syntax
3. Ability to send multiple API requests to perform boolean-based data extraction

An attacker crafts API requests with filter parameters targeting sensitive columns. By analyzing whether records are returned based on specific filter values, the attacker can systematically extract sensitive data. For super admin users, this includes password hashes and reset tokens for all users. For lower-privileged admins, this allows access to sensitive API user information.

The attack methodology involves iterating through possible character values for each position in the target field, building up the complete value based on positive matches in the API responses.

Detection Methods for CVE-2023-22894

Indicators of Compromise

• Unusual patterns of API requests with filter parameters targeting sensitive user fields
• High volume of user query requests from a single admin account in a short timeframe
• API requests filtering on columns like password, resetPasswordToken, or similar sensitive fields
• Sequential or systematic query patterns indicative of character-by-character extraction attempts

Detection Strategies

• Monitor Strapi API logs for excessive filtering operations on user endpoints
• Implement rate limiting on admin API endpoints to slow down automated extraction attempts
• Configure alerting for unusual admin activity patterns, particularly bulk user queries
• Deploy web application firewall rules to detect query filter abuse patterns

Monitoring Recommendations

• Enable detailed logging for all admin panel API requests including query parameters
• Set up anomaly detection for admin accounts querying user data at abnormal rates
• Implement baseline analysis for typical admin query behavior to identify deviations
• Review admin access logs regularly for accounts accessing user data beyond their normal scope

How to Mitigate CVE-2023-22894

Immediate Actions Required

• Upgrade Strapi to a version newer than 4.5.5 immediately
• Audit admin panel access and remove unnecessary privileges from accounts
• Rotate all user password reset tokens as a precautionary measure
• Review logs for any suspicious query filter activity that may indicate prior exploitation

Patch Information

Strapi has addressed this vulnerability in versions released after 4.5.5. Organizations should update to the latest stable release to receive this fix along with other security improvements. Detailed information about the security fix is available in the Strapi Security Disclosure Blog and GitHub Release Notes.

After upgrading, administrators should:

1. Force password resets for all users as a precaution
2. Invalidate existing password reset tokens
3. Review and audit admin account permissions

Workarounds

• Implement strict role-based access control limiting admin panel access to essential personnel only
• Deploy a web application firewall with rules to detect and block suspicious query filter patterns
• Configure network-level restrictions to limit admin panel access to trusted IP ranges
• Consider implementing additional authentication factors for admin panel access

# Configuration example
# Restrict admin panel access by IP in reverse proxy (nginx example)
location /admin {
    allow 10.0.0.0/8;      # Internal network only
    allow 192.168.1.0/24;  # VPN network
    deny all;
    proxy_pass http://strapi_backend;
}

# Enable request logging for audit purposes
access_log /var/log/nginx/strapi_admin_access.log detailed;