CVE-2023-22621

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

Exploit for Injection in Strapi

CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting E...

@antgineering-studio/strapi (4.5.5), @chargeover/strapi (0.0.1-rc1.1) +20 more potentially affected by CVE-2023-22621 via @strapi/plugin-email (>=4.0.0, <=4.5.5)

@strapi/plugin-email NPM version =4.0.0, =4.2.0, =4.2.2, =1.0.1, =0.1.1, =1.0.0-alpha.0, =3.1.2, =1.0.0, =4.0.0-beta.0, =4.2.3-a, =4.3.65 - easylaser-vn-cms 0.1.0 and more Source cves: CVE-2023-22621 Source advisory: OSV:GHSA-2H87-4Q2W-V4HF...

@chargeover/strapi (0.0.1-rc1.1), @mattie-bundle/mattie-strapi-bundle-example (>=1.0.0-alpha.0, <=1.0.0-alpha.3) +7 more potentially affected by CVE-2023-22621 via @strapi/plugin-users-permissions (>=4.0.0-beta.0, <=4.5.1)

@strapi/plugin-users-permissions NPM version =4.0.0-beta.0, =1.0.0-alpha.0, =2.1.0, =1.0.0, =1.0.2 - easylaser-vn-cms 0.1.0 - strapi-ent-a 0.1.0 - strapi-fcm 0.1.0 - strapi-voting 0.2.1 - sveltekit-strapi 0.1.0 Source cves: CVE-2023-22621 Source advisory: OSV:GHSA-2H87-4Q2W-V4HF...

CVE-2023-22621

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

CVE-2023-22621

Strapi versions through 4.5.5 are vulnerable to Server-Side Template Injection (SSTI) , which can lead to Remote Code Execution (RCE) . The root cause is located in the sendTemplatedEmail function, where the lodash template engine renders email templates without sufficient validation, allowing an...

CVE-2023-22621

creationtimestamp| type| source ---|---|--- 2023-04-18 09:12:23+00:00| published-proof-of-concept| https://t.me/ptswarm/170 2023-04-18 17:16:58+00:00| published-proof-of-concept| Telegram/BDIuQxJm2Cl1hcH3rBtjVuiBaQPlmqaGA0Zegr2NgVBdQWM 2023-04-25 15:53:44+00:00| published-proof-of-concept|...