Improper Query Parameter Sanitization in Strapi's Document Service

CVE-2024-56143

What is CVE-2024-56143?

Strapi, a popular open-source headless content management system, contains a vulnerability in its document service that affects versions 5.0.0 through 5.5.1. This flaw arises from improper sanitization of query parameters used with the lookup operator, allowing an attacker to craft a malicious query. By exploiting this vulnerability, an attacker can gain unauthorized access to sensitive private fields, including administrative passwords and reset tokens. This issue has been addressed in version 5.5.2, where improved input validation measures were implemented to safeguard against such unauthorized data exposure.

References