CVE-2025-64526

Executive Summary

CVE-2025-64526 is a vulnerability in the Strapi headless CMS, specifically in the rate-limit middleware of the users-permissions plugin. The flaw allows an unauthenticated attacker to bypass per-IP rate limiting on authentication-related endpoints by injecting an arbitrary email field into the request body. This enables high-volume credential brute-force, password-reset code brute-force, and credential-stuffing attacks. The vulnerability affects Strapi versions prior to 5.45.0. The fix is available in version 5.45.0, which restricts the use of the email field in rate-limit key derivation to only those routes where it is a legitimate part of the schema.

Supply Chain & Package Security

Strapi is an open-source headless CMS distributed via npm. The vulnerability exists in the @strapi/plugin-users-permissions package. Organizations using Strapi should verify their dependency version and update to 5.45.0 or later. The package is widely used in Node.js environments, and the vulnerability can be exploited without authentication, making it a critical supply chain risk for any application using an affected version.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Base Score: 5.3 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: None
• Integrity Impact: Low
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the practical impact is significant because it enables brute-force attacks against authentication mechanisms, potentially leading to account takeover.

Deep Dive & Mechanics

The vulnerability lies in the rate-limit middleware of the users-permissions plugin. The middleware constructs a rate-limit key using the formula: ${userIdentifier}:${requestPath}:${ctx.request.ip}. The userIdentifier is derived from ctx.request.body.email. On routes like /auth/forgot-password and /auth/local/register, the email field is a legitimate part of the request body, so this scoping is correct. However, on routes such as /auth/local, /auth/reset-password, and /auth/change-password, the email field is not part of the route contract. An attacker can include an arbitrary email value in the request body, causing the middleware to generate a unique rate-limit key for each request. This effectively bypasses per-IP throttling, allowing an attacker to send a high volume of authentication attempts without being rate-limited.

The patch in version 5.45.0 introduces an allow-list of routes that legitimately use the email field. For routes not on the allow-list, the middleware falls back to a fixed identifier-less key, ensuring per-IP throttling remains effective.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-5.45.0):

// In the rate-limit middleware
const userIdentifier = ctx.request.body.email;
const rateLimitKey = `${userIdentifier}:${requestPath}:${ctx.request.ip}`;
// ... use rateLimitKey for rate limiting

Patched Code (5.45.0+):

// In the rate-limit middleware
const allowedRoutes = ['/auth/forgot-password', '/auth/local/register'];
let userIdentifier = '';
if (allowedRoutes.includes(requestPath)) {
  userIdentifier = ctx.request.body.email;
}
const rateLimitKey = `${userIdentifier}:${requestPath}:${ctx.request.ip}`;
// ... use rateLimitKey for rate limiting

Exploitation & Lab Setup

Red Team

Prerequisites:

• A Strapi instance running version < 5.45.0
• Network access to the Strapi API

Exploitation Steps:

1. Identify the target Strapi instance and its authentication endpoints (e.g., /auth/local, /auth/reset-password).
2. Send a series of POST requests to the target endpoint, each with a different email field in the request body.
3. Observe that rate limiting is not triggered, allowing for high-volume brute-force attempts.

Example curl command:

for i in {1..1000}; do
  curl -X POST https://target-strapi.com/auth/local \
    -H "Content-Type: application/json" \
    -d "{\"identifier\":\"admin@example.com\",\"password\":\"password$i\",\"email\":\"attacker$i@example.com\"}"
done

Blue Team

Detection:

• Monitor for a high volume of authentication requests from a single IP address with varying email fields.
• Look for requests to /auth/local, /auth/reset-password, or /auth/change-password that include an email field in the body.

Mitigation:

• Immediately upgrade to Strapi version 5.45.0 or later.
• Implement additional rate limiting at the network level (e.g., using a WAF or reverse proxy).
• Enable logging and alerting for unusual authentication patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of POST requests to /auth/local, /auth/reset-password, or /auth/change-password from a single IP.
  • Requests containing an email field in the body on endpoints where it is not expected.
• Log IOCs:
  • Repeated authentication failures from the same IP with varying email values.
  • Rate-limit logs showing a large number of unique keys for a single IP.

Detection Engineering

YARA Rule

rule CVE_2025_64526_Strapi_RateLimit_Bypass {
  meta:
    description = "Detects attempts to bypass rate limiting in Strapi by injecting email field"
    author = "Valters IT"
    date = "2025-04-10"
    reference = "CVE-2025-64526"
  strings:
    $email_field = /"email"\s*:\s*"[^"]*"/
    $auth_endpoint = /\/auth\/(local|reset-password|change-password)/
  condition:
    $auth_endpoint and $email_field
}

Sigma Rule

title: Strapi Rate Limit Bypass via Email Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to bypass rate limiting in Strapi by injecting email field into authentication requests
author: Valters IT
date: 2025-04-10
logsource:
  category: webserver
  product: nginx
detection:
  selection:
    http.method: 'POST'
    http.url|contains: 
      - '/auth/local'
      - '/auth/reset-password'
      - '/auth/change-password'
    http.body|contains: '"email"'
  condition: selection
falsepositives:
  - Legitimate requests with email field on allowed routes
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-64526 Strapi Rate Limit Bypass"; flow:to_server; http.method; content:"POST"; http.uri; content:"/auth/local" or content:"/auth/reset-password" or content:"/auth/change-password"; http.request_body; content:"\"email\""; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Strapi to version 5.45.0 or later.
2. If immediate upgrade is not possible, implement a WAF rule to block requests to /auth/local, /auth/reset-password, and /auth/change-password that contain an email field in the body.
3. Monitor authentication logs for unusual patterns.

Long-term Recommendations:

• Regularly update Strapi and its plugins.
• Implement additional rate limiting at the network level.
• Use multi-factor authentication to reduce the impact of credential brute-force attacks.

Valters IT Signature This report was generated by Valters IT DevSecOps AI Assistant. For questions, contact security@valters-it.com.