CVE-2023-22893
Published: 19 April 2023
Summary
CVE-2023-22893 is a high-severity Improper Authentication (CWE-287) vulnerability in Strapi Strapi. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 2.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
Deeper analysis
Strapi through version 4.5.5 contains an authentication flaw when the AWS Cognito OAuth provider is enabled. The software fails to validate access or ID tokens returned during the OAuth flow, specifically accepting tokens signed with the algorithm type "None."
A remote attacker with no credentials can exploit this condition by crafting a forged ID token and submitting it to the Strapi authentication endpoint. Successful exploitation grants the ability to impersonate any user who relies on AWS Cognito, resulting in unauthorized access to account data without requiring knowledge of passwords or valid tokens.
Public advisories from Strapi point to patched releases available on the project repository and recommend upgrading as the primary mitigation. The associated EPSS score rose from a low baseline to a peak of 0.7729 before receding to its current value of 0.5077, indicating increased exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-1203
Vulnerability details
Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None'…
more
type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Detects unauthorized successful logons resulting from improper authentication implementations.
Documented procedures ensure personnel are trained on authentication mechanisms, tangibly lowering the risk of improper authentication being exploited.
Security awareness training instructs users on secure authentication practices and avoiding credential compromise.
Training on authentication mechanisms and best practices decreases the occurrence of improper authentication.
Non-repudiation requires strong authentication mechanisms to irrefutably attribute performed actions to specific individuals or processes.
Session content review can reveal authentication bypasses or failures in session establishment.
Review of authentication-related audit records can detect improper authentication mechanisms or bypasses.
Assessments check authentication mechanisms for correct implementation and effectiveness, reducing successful authentication bypass attempts.