Improper Query Parameter Sanitization in Strapi's Document Service

CVE-2024-56143

What is CVE-2024-56143?

Strapi, a popular open-source headless content management system, contains a vulnerability in its document service that affects versions 5.0.0 through 5.5.1. This flaw arises from improper sanitization of query parameters used with the lookup operator, allowing an attacker to craft a malicious query. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive private fields, including administrative passwords and reset tokens. This issue has been addressed in version 5.5.2, where improved input validation measures were implemented to safeguard against such unauthorized data exposure.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References