Leaking sensitive user information still possible by filtering on private with prefix fields

CVE-2023-34235

What is CVE-2023-34235?

Strapi, an open-source headless content management system, has a vulnerability that allows unauthorized access to private fields. The issue arises when users utilize a custom t(number) prefix, which causes the default protection mechanisms to be bypassed. Specifically, sensitive data such as passwords (password) can be manipulated during Knex SQL queries, exposing them through unprotected queries like t1.password. This situation can lead to significant security risks, including the potential compromise of administrative passwords and reset tokens. Resolution for this vulnerability is available in version 4.10.8 and above.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References