Strapi Sensitive Information Disclosure via Query Filter Vulnerability (CVE-2023-22894)
Executive & SecOps Summary
SECOPS ASSESSMENTAll Strapi deployments running version 4.5.5 or earlier.
Authenticated attackers with admin panel access can leak sensitive user data, including password hashes and reset tokens, via side-channel inference.
Immediately upgrade Strapi to version 4.6.0 or later.
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Immediate Upgrade
Update your Strapi dependencies to version 4.6.0 or higher using your package manager.
# Using npm
npm install @strapi/strapi@latest @strapi/plugin-users-permissions@latest
# Using yarn
yarn add @strapi/strapi@latest @strapi/plugin-users-permissions@latest2. Temporary Mitigations
If an immediate patch is not feasible:
- Restrict Admin Access: Implement IP whitelisting for the
/adminendpoint via WAF or Reverse Proxy configurations. - Role Audit: Review and downgrade unnecessary administrative privileges for users.
- Detection: Monitor API logs for anomalous patterns of repeated filtering queries targeting user-related endpoints.
Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
CVE-2023-22894 is a sensitive information disclosure vulnerability (CWE-312) residing in Strapi's query filtering mechanism. An attacker with access to the admin panel can craft malicious API requests using filters on sensitive database columns. By observing the API's response (e.g., whether a record is returned or not), the attacker can systematically infer sensitive values like password hashes and password reset tokens. If a Super Admin account is compromised, this can lead to a full credential leak of all users. Even lower-privileged roles like 'Editor' can exploit this to harvest API user details. Given its inclusion in the CISA KEV catalog and an EPSS score of 0.94, this vulnerability is actively being targeted in the wild for lateral movement and credential harvesting.
Official Vendor Advisories & References
Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.