Exploiting Strapi for Sensitive Information Disclosure: CVE-2023-22894

An in-depth analysis of CVE-2023-22894, a serious vulnerability in Strapi leading to the exposure of sensitive user information. We will detail the exploit strategy, what made it effective, and practical insights for red teamers.

Campaign or TTP Overview

In February 2023, security researchers uncovered CVE-2023-22894, a vulnerability in Strapi, an open-source headless CMS. This flaw involves the cleartext storage of sensitive information within the admin panel, making it an attractive target for attackers aiming to harvest credentials and other personal data. With its growing adoption by enterprises for content management, Strapi’s user base represented a significant target for this vulnerability. No specific attacker group has been publicly attributed, but incidents were reported across various sectors, including education and technology, highlighting its widespread utilization.

Exploitation of this vulnerability could allow unauthorized individuals to gain access to sensitive user details without needing prior authentication. The capability to chain this flaw with other exploits potentially facilitates escalating privileges to achieve remote code execution. Recognizing the potential severity, the issue has been included in the CISA Known Exploited Vulnerabilities Catalog.

How It Was Built

The exploitation process typically begins with attackers scanning for Strapi installations with the vulnerable version. This initial step leverages automated tools to identify targets systematically. Once a vulnerable instance is located, attackers exploit the poorly secured admin panel, which in default settings, does not encrypt stored credentials.


POST /admin/login HTTP/1.1

Host: targetdomain.com

Content-Type: application/json

Accept: application/json



{

  "identifier": "admin@example.com",

  "password": "password123"

}

The admin panel itself can be accessed using common email-password combinations or default credentials left unchanged post-deployment. Attackers crafted convincing phishing emails targeting organization staff, posing as internal IT support. These emails, branded with company logos, directed users to the genuine-looking but compromised admin login pages under domains like

support.targetdomain-help.com

, enhancing the deception.

The payload involved leveraging the admin panel to extract information such as username, email addresses, and hashed passwords. With access to these credentials, attackers could potentially pivot to other systems connected within the organization’s network.

Why It Worked

The success of these exploitation attempts stemmed from several key tactics:

Commonly Used Platforms: Strapi’s popularity made its users a high-yield target. The widespread adoption increased the likelihood of encountering installations with weak or default security settings.

Phishing Lures: Attackers used company-branded phishing emails that appeared legitimate, increasing the likelihood of user interaction. By mimicking internal communications and using subdomains related to the organization, these lures bypassed initial suspicion.

Direct Access through Misconfiguration: The direct access to the admin panel due to misconfiguration allowed attackers to manipulate the entity directly. Systems configured to use default credentials or lacking proper access control made the exploitation feasible with minimal resistance.

Operator Takeaways

For red teamers, the exploitation of CVE-2023-22894 offers valuable lessons in campaign design and execution:

Target Soft Spots: Focus on widespread technical platforms that might suffer from inadequate default settings and lack of user awareness about security practices.

Create Compelling Pretexts: Develop phishing themes that integrate seamlessly with target organizations. Utilize readily available information to craft emails that an unaware user would perceive as coming from a trusted source.

Automation for Reconnaissance: Automate the discovery of vulnerable instances using publicly available scanning tools to streamline initial target acquisition phases.

Good / Better / Best

Good: Exploit outdated software systems known for security issues without customization to your target.

Better: Conduct social engineering that aligns emails with recent company events or announcements to elicit stronger emotional responses.

Best: Combine technical exploits with deeply tailored phishing campaigns that leverage insider knowledge to maximize believability and user interaction.

References

CISA Known Exploited Vulnerabilities Catalog

Strapi Official Site