Strapi CVE-2023-22621远程代码执行漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
• https://nvd.nist.gov/vuln/detail/CVE-2023-22621
• https://github.com/advisories/GHSA-2h87-4q2w-v4hf
• https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-22621.yaml
• https://avd.aliyun.com/detail?id=AVD-2023-22621
• https://mvip.tophant.com/detail/1648748649922039808
• https://www.ghostccamm.com/blog/multi_strapi_vulns/
• https://ccb.belgium.be/advisories/warning-unauthenticated-remote-code-execution-rce-vulnerabilities-strapi-servers-patch
• https://blog.nsfocus.net/strapi/
• https://github.com/strapi/strapi/releases

Related Vulnerabilities

• PoCCVE-2019-18818: strapi CMS <3.0.0-beta.17.5 - Admin Password Reset
• PoCCVE-2023-22621: Strapi Versions <=4.5.5 - SSTI to Remote Code Execution
• PoCCVE-2023-22893: Strapi Versions <=4.5.6 - Authentication Bypass
• PoCstrapi-admin-installer: Strapi Admin - Installer
• Strapi <4.5.6 登陆后邮件模版注入远程代码执行漏洞
• Strapi CMS admin 密码重置 -未授权(CVE-2019-18818)
• Strapi CMS 3.0.0-beta命令执行(CVE-2019-18818,CVE-2019-19609)