CVE-2021-28128
📋 TL;DR
This vulnerability in Strapi allows attackers who have obtained a valid session to change a user's password without providing the current password. This enables account takeover attacks where attackers can lock out legitimate users and gain persistent access. All Strapi deployments up to version 3.6.0 are affected.
💻 Affected Systems
- Strapi
📦 What is this software?
Strapi by Strapi
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of admin accounts leading to full system control, data exfiltration, and privilege escalation across the entire Strapi instance.
Likely Case
Account takeover of individual users, potentially including administrators, leading to unauthorized content changes, data access, and persistence in the system.
If Mitigated
Limited impact with proper session management, strong authentication controls, and network segmentation preventing unauthorized access to admin panels.
🎯 Exploit Status
Exploitation requires a valid session cookie. Attack chain typically involves session hijacking, XSS, or other methods to obtain valid authentication tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.1 and later
Vendor Advisory: https://strapi.io/changelog
Restart Required: Yes
Instructions:
1. Backup your Strapi instance and database. 2. Update Strapi to version 3.6.1 or later using npm update strapi@latest. 3. Restart the Strapi service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Session Management Hardening
allImplement strict session management controls including short session timeouts, secure cookie attributes, and IP binding.
Admin Panel Access Restriction
allRestrict access to the admin panel (/admin) using network controls or web application firewalls.
🧯 If You Can't Patch
- Implement multi-factor authentication for all admin accounts
- Monitor for suspicious password change events in application logs
🔍 How to Verify
Check if Vulnerable:
Check Strapi version in package.json or via strapi version command. If version is 3.6.0 or earlier, the system is vulnerable.Check Version:
strapi versionVerify Fix Applied:
After updating, verify the password change functionality now requires current password entry. Test with a non-admin account.📡 Detection & Monitoring
Log Indicators:
- Password change events without current password verification
- Multiple failed login attempts followed by successful password change
- Admin panel access from unusual IP addresses
Network Indicators:
- HTTP POST requests to /admin/users-permissions/users/:id without currentPassword parameter
- Unusual patterns of admin panel access
SIEM Query:
source="strapi" AND (event="password_change" AND NOT current_password_verified="true")🔗 References
- https://github.com/strapi/strapi/releases
- https://strapi.io/changelog
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-008.txt
- https://github.com/strapi/strapi/releases
- https://strapi.io/changelog
- https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-008.txt
