CVE-2021-46440
📋 TL;DR
This vulnerability in Strapi's DOCUMENTATION plugin stores passwords in a recoverable format (base64 encoded in cookies). Attackers who intercept HTTP requests can decode cookies to obtain cleartext passwords, potentially gaining API documentation access for further attacks. Affects Strapi users with the documentation plugin enabled.
💻 Affected Systems
- Strapi
📦 What is this software?
Strapi by Strapi
Strapi by Strapi
⚠️ Risk & Real-World Impact
Worst Case
Attackers obtain administrative credentials, access sensitive API documentation, perform API attacks leading to data breach or system compromise.
Likely Case
Attackers gain limited API documentation access, potentially discovering other vulnerabilities or sensitive endpoints.
If Mitigated
With proper network controls and updated versions, risk is limited to authenticated sessions only.
🎯 Exploit Status
Exploitation requires intercepting HTTP requests/cookies; base64 decoding is trivial.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Strapi 3.6.9, Strapi 4.1.5
Vendor Advisory: https://github.com/strapi/strapi/pull/12246
Restart Required: Yes
Instructions:
1. Update Strapi to version 3.6.9 or 4.1.5 or later. 2. Restart the Strapi service. 3. Regenerate all user sessions/cookies.
🔧 Temporary Workarounds
Disable DOCUMENTATION plugin
allTemporarily disable the vulnerable plugin until patching is possible.
Edit Strapi config to disable documentation plugin
Implement HTTPS and secure cookies
allEnforce HTTPS and secure cookie attributes to prevent interception.
Configure Strapi to use HTTPS only
Set cookie security flags: Secure, HttpOnly
🧯 If You Can't Patch
- Restrict access to documentation endpoints using network ACLs or WAF rules.
- Implement session monitoring and alert on unusual cookie access patterns.
🔍 How to Verify
Check if Vulnerable:
Check Strapi version and if documentation plugin is enabled; versions <3.6.9 or 4.x <4.1.5 are vulnerable.Check Version:
strapi versionVerify Fix Applied:
Confirm Strapi version is >=3.6.9 or >=4.1.5 and test that cookies no longer contain base64-encoded passwords.📡 Detection & Monitoring
Log Indicators:
- Unusual access to documentation endpoints
- Multiple failed authentication attempts followed by documentation access
Network Indicators:
- HTTP requests with base64-encoded cookie values being intercepted
SIEM Query:
source="strapi" AND (uri="/documentation" OR cookie="*base64*")🔗 References
- http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html
- https://github.com/strapi/strapi/pull/12246
- https://hub.docker.com/r/strapi/strapi
- https://strapi.io/
- http://packetstormsecurity.com/files/166915/Strapi-3.6.8-Password-Disclosure-Insecure-Handling.html
- https://github.com/strapi/strapi/pull/12246
- https://hub.docker.com/r/strapi/strapi
- https://strapi.io/
