CVE-2024-34065: Strapi Auth Bypass Vulnerability

CVE-2024-34065 Overview

CVE-2024-34065 affects Strapi, an open-source headless content management system. The vulnerability resides in the @strapi/plugin-users-permissions package in versions before 4.24.2. Attackers can chain two flaws to bypass authentication: an open redirect and the transmission of session tokens as URL query parameters. An unauthenticated attacker can leverage this chain to capture third-party authentication tokens and gain access to Strapi applications. Exploitation requires a single user click on an attacker-crafted link. Strapi released a patch in @strapi/plugin-users-permissions version 4.24.2.

Critical Impact
Unauthenticated attackers can hijack third-party OAuth tokens and bypass authentication in Strapi applications through a one-click user interaction.

Affected Products

Strapi @strapi/plugin-users-permissions versions prior to 4.24.2
Strapi applications using third-party authentication providers
Strapi deployments relying on the users-permissions plugin for OAuth flows

Discovery Timeline

2024-06-12 - CVE-2024-34065 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2024-34065

Vulnerability Analysis

The flaw maps to [CWE-294: Authentication Bypass by Capture-replay]. It results from combining two distinct weaknesses in the @strapi/plugin-users-permissions package. The first is an open redirect that allows attackers to control the destination URL after authentication. The second is the transmission of session tokens as URL query parameters rather than through secure channels such as POST request bodies or Authorization headers. When chained, an attacker can redirect a victim through a legitimate Strapi authentication flow and capture the resulting third-party token from the URL when the browser follows the attacker-controlled redirect.

Root Cause

The root cause is twofold. The users-permissions plugin fails to validate redirect targets against an allowlist, enabling arbitrary redirection to attacker-controlled domains. Additionally, the plugin appends session and third-party tokens to URLs as query string parameters, exposing them to referrer leakage, browser history, server logs, and intermediate proxies. These two design choices combine to enable token exfiltration without compromising the Strapi server itself.

Attack Vector

An attacker crafts a phishing link pointing to a vulnerable Strapi instance. The link initiates an OAuth flow with a redirect parameter referencing an attacker-controlled domain. When the victim authenticates with a legitimate identity provider, Strapi appends the resulting token to the redirect URL as a query parameter. The browser then sends the victim to the attacker's server with the token visible in the request URL. The attacker harvests the token from server logs and replays it against the Strapi API to impersonate the victim.

The vulnerability mechanism is documented in the Strapi GitHub Security Advisory GHSA-wrvh-rcmr-9qfc. No public proof-of-concept code has been released.

Detection Methods for CVE-2024-34065

Indicators of Compromise

Unusual Referer headers in Strapi application logs pointing to external domains following OAuth callbacks
Authentication callback requests containing redirect or callback parameters referencing untrusted hostnames
Successful third-party authentication events followed by API access from unexpected IP addresses or user agents
Web server access logs showing tokens or session identifiers in URL query strings

Detection Strategies

Inspect Strapi reverse proxy and application logs for OAuth callback requests with external redirect targets
Correlate authentication events with subsequent API calls to detect token replay from new geographies or networks
Audit installed @strapi/plugin-users-permissions versions across all Strapi deployments to identify versions below 4.24.2

Monitoring Recommendations

Enable verbose logging on Strapi authentication endpoints including /connect/* and /auth/* routes
Forward Strapi application logs to a centralized SIEM with alerting on anomalous redirect parameters
Monitor outbound DNS and HTTP traffic from user workstations toward newly registered domains referenced in phishing links

How to Mitigate CVE-2024-34065

Immediate Actions Required

Upgrade @strapi/plugin-users-permissions to version 4.24.2 or later across all Strapi deployments
Invalidate all active third-party authentication sessions and force users to re-authenticate
Review authentication logs for the period preceding the patch to identify suspicious OAuth callbacks
Rotate any third-party API credentials or OAuth client secrets that may have been exposed

Patch Information

Strapi addressed CVE-2024-34065 in @strapi/plugin-users-permissions version 4.24.2. The fix is described in the Strapi GitHub Security Advisory GHSA-wrvh-rcmr-9qfc. Administrators should update through their standard package manager and redeploy affected applications.

Workarounds

Restrict access to Strapi authentication endpoints behind a web application firewall with redirect parameter validation
Disable third-party authentication providers in the users-permissions plugin until the patch is applied
Implement strict allowlists for OAuth callback URLs at the identity provider configuration level

bash

# Upgrade the vulnerable package to the patched version
npm install @strapi/plugin-users-permissions@4.24.2

# Verify the installed version
npm list @strapi/plugin-users-permissions

# Rebuild and restart the Strapi application
npm run build
npm run start