CVE-2024-29181

Executive Summary

CVE-2024-29181 is a low-severity authorization bypass vulnerability in Strapi, an open-source headless CMS. The flaw allows a user with the Author role to view a list of associated items from a collection that they did not create, violating the intended access control. This occurs when a super admin creates a collection with an association to another collection. The vulnerability is patched in Strapi version 4.19.1.

Supply Chain & Package Security

This vulnerability affects the @strapi/plugin-content-manager npm package. Organizations using Strapi should verify their dependency tree and ensure the package is updated to version 4.19.1 or later. The package is widely used in the Node.js ecosystem, and the fix is available via the npm registry.

CVSS Breakdown & Threat Level

• CVSS Score: 2.3 (Low)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Author role)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (unauthorized access to associated item IDs)
• Integrity Impact: None
• Availability Impact: None

The low score reflects the high privileges required (Author role) and the limited impact (only viewing IDs of associated items, not full content).

Deep Dive & Mechanics

The vulnerability lies in the content-manager plugin's authorization logic. When a super admin creates a collection type that has a relation (association) to another collection, the system fails to properly filter the list of related items based on the user's permissions. An Author role user, who should only see items they created, can instead see the IDs of all items in the related collection.

The root cause is an improper access control check in the API endpoint that returns the list of available items for a relation field. The code does not enforce the "created by" filter for users with the Author role when fetching the related collection's items.

Vulnerable vs. Patched Code

Vulnerable Code (pre-4.19.1): The vulnerable code likely resides in the content-manager plugin's service layer, where the query for related items does not include a filter for the current user's ID when the user has the Author role.

// Vulnerable: No user-specific filter
const relatedItems = await strapi.query(relatedModel.uid).findMany({
  // ... no user filter
});

Patched Code (4.19.1): The patched version adds a filter to restrict the query to only items created by the current user when the user has the Author role.

// Patched: Adds user-specific filter for Author role
const filters = {};
if (user.roles.some(role => role.name === 'Author')) {
  filters.createdBy = user.id;
}
const relatedItems = await strapi.query(relatedModel.uid).findMany({
  filters,
});

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a Strapi instance with version < 4.19.1
• An Author role user account
• A collection type with a relation to another collection, created by a super admin

Exploitation Steps:

1. Log in as an Author role user.
2. Navigate to the content manager for a collection that has a relation field.
3. When creating or editing an item, interact with the relation field to see the list of available items.
4. Observe that the list contains items created by other users, not just the current user.

Proof of Concept:

# Assuming the Strapi API is accessible
curl -X GET "http://target-strapi.com/api/content-manager/collection-types/api::article.article" \
  -H "Authorization: Bearer <author_user_jwt>" \
  -H "Content-Type: application/json"
# The response may include related items from other users

Blue Team

Detection:

• Monitor API logs for unusual access patterns to content-manager endpoints by Author role users.
• Look for requests where an Author role user queries a collection with a relation field and receives a large number of results (indicating they are seeing all items, not just their own).

Mitigation:

• Immediately upgrade to Strapi 4.19.1 or later.
• If immediate upgrade is not possible, implement a custom middleware to enforce the "created by" filter for Author role users on relation fields.

Indicators of Compromise (IOCs)

• Log Entries: API access logs showing Author role users querying content-manager endpoints for collections with relations, returning more items than expected.
• Network Traffic: HTTP requests to /api/content-manager/collection-types/* with JWT tokens for Author role users.
• System State: Strapi version < 4.19.1 with @strapi/plugin-content-manager not updated.

Detection Engineering

YARA Rule

rule CVE_2024_29181_Strapi_Authorization_Bypass {
    meta:
        description = "Detects Strapi content-manager plugin versions vulnerable to CVE-2024-29181"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29181"
    strings:
        $vulnerable_version = /"version":\s*"4\.(1[0-8]|[0-9])\.[0-9]+"/ nocase
        $plugin_name = /@strapi\/plugin-content-manager/
    condition:
        $plugin_name and $vulnerable_version
}

Sigma Rule

title: Strapi CVE-2024-29181 Authorization Bypass Detection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2024-29181 by monitoring API access patterns
author: Valters IT
date: 2024/01/01
logsource:
    category: application
    product: strapi
detection:
    selection:
        http.url|contains: "/api/content-manager/collection-types/"
        http.method: "GET"
        user.role: "Author"
    condition: selection
falsepositives:
    - Legitimate use by Author role users viewing their own items
level: low

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-29181 Strapi Authorization Bypass Attempt"; flow:to_server; content:"/api/content-manager/collection-types/"; http_uri; content:"Authorization"; http_header; content:"Bearer"; http_header; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Upgrade @strapi/plugin-content-manager to version 4.19.1 or later.

   npm install @strapi/plugin-content-manager@4.19.1
   

2. Verification: After upgrade, verify the fix by testing with an Author role user that they cannot see other users' items in relation fields.

3. Workaround: If upgrade is not possible, implement a custom policy or middleware to enforce the "created by" filter for Author role users on all relation fields.

4. Monitoring: Enable detailed logging for content-manager API endpoints and monitor for unusual access patterns.

5. Least Privilege: Review user roles and permissions to ensure only necessary users have the Author role.

Valters IT