Leaking sensitive user information still possible by filtering on private with prefix fields

CVE-2023-34235

What is CVE-2023-34235?

Strapi, an open-source headless content management system, has a vulnerability that allows unauthorized access to private fields. The issue arises when users utilize a custom t(number) prefix, which causes the default protection mechanisms to be bypassed. Specifically, sensitive data such as passwords (password) can be manipulated during Knex SQL queries, exposing them through unprotected queries like t1.password. This situation can lead to significant security risks, including the potential compromise of administrative passwords and reset tokens. Resolution for this vulnerability is available in version 4.10.8 and above.

References