CVE-2024-56143: Strapi Information Disclosure Flaw

CVE-2024-56143 Overview

CVE-2024-56143 affects Strapi, an open-source headless content management system widely deployed for API-driven applications. The vulnerability exists in the document service lookup operator, which fails to sanitize query parameters targeting private fields. Attackers can craft requests using the lookup parameter to read sensitive data, including admin password hashes and password reset tokens. The flaw impacts Strapi versions from 5.0.0 to versions before 5.5.2 and is classified under [CWE-639] Authorization Bypass Through User-Controlled Key. Strapi addressed the issue in release 5.5.2.

Critical Impact
Unauthenticated attackers can extract admin password hashes and reset tokens by injecting the lookup parameter into document service queries, enabling full administrative takeover.

Affected Products

Strapi 5.0.0 through 5.5.1
Strapi document service lookup operator
Strapi admin authentication subsystem (indirect exposure of credentials and reset tokens)

Discovery Timeline

2025-10-16 - CVE-2024-56143 published to NVD
2025-12-31 - Last updated in NVD database

Technical Details for CVE-2024-56143

Vulnerability Analysis

The vulnerability resides in Strapi's document service, specifically in how the lookup parameter is processed when constructing queries. Strapi's content API normally restricts access to fields marked private in the content type schema, such as administrator password hashes and reset tokens. The lookup operator, however, bypassed this filtering layer.

An attacker submits a query that includes a lookup clause referencing a private field. The document service passes that clause directly into the underlying database query without sanitizing or removing private attributes. The response leaks the requested field values through inference, allowing the attacker to enumerate sensitive data character by character or via boolean comparisons.

Because the issue affects the admin user collection, the most direct exploitation path targets resetPasswordToken and the bcrypt password hash. An attacker who recovers a valid reset token can complete the password reset flow and gain administrator access.

Root Cause

The root cause is missing parameter sanitization in the draft-and-publish and repository layers of the document service. The lookup object passed by callers was merged into internal query parameters without stripping fields marked private in the schema. This violates the authorization model Strapi enforces elsewhere through field-level access controls.

Attack Vector

Exploitation requires only network access to the Strapi content API. No authentication or user interaction is required. The attacker sends crafted HTTP requests containing the lookup parameter against any endpoint backed by the vulnerable document service.

typescript

// Patch excerpt: packages/core/core/src/services/document-service/draft-and-publish.ts
     return params;
   }
 
+  // @ts-expect-error: we need to create a different typing for internal params
   const lookup = params.lookup || {};
 
   switch (params?.status) {

Source: Strapi commit 0c6e0953

typescript

// Patch excerpt: packages/core/core/src/services/document-service/repository.ts
 import { omit, assoc, merge, curry } from 'lodash/fp';
 
-import { async, contentTypes as contentTypesUtils, validate } from '@strapi/utils';
+import { async, contentTypes as contentTypesUtils, validate, errors } from '@strapi/utils';
 
 import { UID } from '@strapi/types';
 import { wrapInTransaction, type RepositoryFactoryMethod } from './common';

Source: Strapi commit 0c6e0953. The patch introduces validation via @strapi/utilserrors and reshapes how the lookup parameter flows through the repository, blocking access to private attributes.

Detection Methods for CVE-2024-56143

Indicators of Compromise

HTTP requests to Strapi content API endpoints containing a lookup query parameter referencing fields such as password, resetPasswordToken, or other attributes marked private.
Repeated query variations against /api/* or admin collection routes consistent with field enumeration or blind extraction.
Successful administrator logins following anomalous password reset flows initiated without a corresponding user-driven reset request.

Detection Strategies

Inspect web server and reverse proxy logs for query strings containing lookup[ patterns targeting administrator or user collections.
Compare the running Strapi version against 5.5.2. Any deployment between 5.0.0 and 5.5.1 is vulnerable regardless of observed traffic.
Correlate password reset completions with the preceding reset request events. Reset completions without a matching request indicate token theft.

Monitoring Recommendations

Enable verbose request logging on the Strapi API gateway and forward logs to a centralized SIEM for retention and query.
Alert on outbound responses from Strapi that contain bcrypt hash patterns ($2a$, $2b$) or reset token field names.
Monitor admin account creation, role changes, and authentication events for anomalies following any suspicious lookup traffic.

How to Mitigate CVE-2024-56143

Immediate Actions Required

Upgrade Strapi to version 5.5.2 or later on all production, staging, and development environments.
Rotate all administrator passwords and invalidate active sessions after patching to revoke any credentials that may have been exposed.
Invalidate outstanding resetPasswordToken values in the admin users table to prevent replay of stolen tokens.
Review admin audit logs for unauthorized account creation, role escalation, or configuration changes since the deployment of any affected version.

Patch Information

The fix landed in Strapi 5.5.2. The remediation removes the lookup parameter path from the document service and adds explicit error handling using @strapi/utilserrors. Review the Strapi security advisory GHSA-495j-h493-42q2 and the upstream commit 0c6e0953 for the complete code change.

Workarounds

Restrict access to the Strapi content API behind authenticated reverse proxy rules until upgrade is complete.
Deploy a Web Application Firewall (WAF) rule that rejects requests containing the lookup query parameter on content API routes.
Apply network segmentation to limit exposure of the Strapi admin interface to trusted administrative networks only.

bash

# Example WAF rule (ModSecurity) blocking lookup parameter abuse
SecRule ARGS_NAMES "@rx ^lookup(\[|$)" \
    "id:1056143,phase:2,deny,status:400,log,\
    msg:'CVE-2024-56143: Strapi lookup parameter blocked'"

# Upgrade Strapi to the patched release
npm install @strapi/strapi@5.5.2