CVE-2023-22621
Published: 19 April 2023
Summary
CVE-2023-22621 is a high-severity Injection (CWE-74) vulnerability in Strapi Strapi. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 0.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Strapi through version 4.5.5 contains an authenticated Server-Side Template Injection vulnerability that permits arbitrary code execution on the server. The flaw resides in the email template handling component, where insufficient validation allows crafted payloads to bypass checks intended to block code execution.
A remote attacker who has obtained credentials for the Strapi administrative panel can supply a malicious template that results in code running with the privileges of the Strapi process, achieving full confidentiality, integrity, and availability impact as reflected in the CVSS 7.2 score.
Strapi has published security disclosures and corresponding releases that address the issue; administrators are advised to upgrade to a patched version available from the project repository. The EPSS score has remained elevated near its recorded peak of 0.9221 with a current value of 0.9102, indicating sustained exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1157
Vulnerability details
Strapi through 4.5.5 allows authenticated Server-Side Template Injection (SSTI) that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the…
more
server into an email template that bypasses the validation checks that should prevent code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Developer assessments and testing (including injection-focused techniques) identify improper neutralization of special elements, and the verifiable flaw remediation corrects them pre-deployment.
Identifies indicators of injection attacks (command, SQL, LDAP, etc.) via anomaly and attack monitoring.