Description
Strapi 是一个基于Node.js开发的内容管理系统，Users-Permission 插件的电子邮件模板系统用于管理与用户权限相关的电子邮件通知(默认启用)。
Strapi <4.5.6 登陆后邮件模版注入远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/detail?id=AVD-2023-22621
https://mvip.tophant.com/detail/1648748649922039808
https://cn-sec.com/archives/1690268.html
https://github.com/advisories/GHSA-2h87-4q2w-v4hf
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
https://nvd.nist.gov/vuln/detail/CVE-2023-22621
https://www.ghostccamm.com/blog/multi_strapi_vulns/
https://www.sonicwall.com/blog/critical-strapi-vulnerability-allows-rce-via-server-side-template-injection
https://nsfocusglobal.com/strapi-multiple-security-vulnerability-notice/