CVE-2023-22621

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

Exploit for Injection in Strapi

CVE-2023-22621-POC CVE-2023-22621: SSTI to RCE by Exploiting E...

CVE-2023-22621

Strapi through 4.5.5 allows authenticated Server-Side Template Injection SSTI that can be exploited to execute arbitrary code on the server. A remote attacker with access to the Strapi admin panel can inject a crafted payload that executes code on the server into an email template that bypasses t...

CVE-2023-22621

CVE-2023-22621 affects Strapi up to version 4.5.5. An authenticated attacker with admin access can exploit Server-Side Template Injection (SSTI) in email templates to achieve arbitrary code execution on the server. Multiple connected sources confirm the vulnerability vector and potential RCE via ...

CVE-2023-22621

creationtimestamp| type| source ---|---|--- 2023-04-18 09:12:23+00:00| published-proof-of-concept| https://t.me/ptswarm/170 2023-04-18 17:16:58+00:00| published-proof-of-concept| Telegram/BDIuQxJm2Cl1hcH3rBtjVuiBaQPlmqaGA0Zegr2NgVBdQWM 2023-04-25 15:53:44+00:00| published-proof-of-concept|...