CVE-2024-56143
📋 TL;DR
This vulnerability in Strapi allows attackers to access private fields like admin passwords and reset tokens by crafting malicious queries with the lookup parameter. It affects Strapi versions 5.0.0 through 5.5.1. Any organization using vulnerable Strapi instances is at risk of credential exposure.
💻 Affected Systems
- Strapi
📦 What is this software?
Strapi by Strapi
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of admin accounts leading to full system takeover, data exfiltration, and potential ransomware deployment.
Likely Case
Unauthorized access to sensitive data including passwords, reset tokens, and other private fields stored in the CMS.
If Mitigated
Limited exposure if proper network segmentation and access controls prevent external exploitation attempts.
🎯 Exploit Status
The vulnerability requires no authentication and exploitation is straightforward via crafted API queries.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 5.5.2
Vendor Advisory: https://github.com/strapi/strapi/security/advisories/GHSA-495j-h493-42q2
Restart Required: Yes
Instructions:
1. Backup your Strapi instance and database. 2. Update Strapi to version 5.5.2 or later using npm: 'npm update strapi@5.5.2'. 3. Restart the Strapi service. 4. Verify the update was successful.
🔧 Temporary Workarounds
Disable document service lookup operator
allTemporarily disable the vulnerable lookup operator in document service configuration
Modify Strapi configuration to remove or restrict lookup operator functionality
Implement API gateway filtering
allBlock requests containing lookup parameters at the API gateway or WAF level
Configure WAF rules to block requests with 'lookup' parameter patterns
🧯 If You Can't Patch
- Implement strict network access controls to limit Strapi API exposure to trusted sources only
- Enable comprehensive logging and monitoring for suspicious lookup parameter usage
🔍 How to Verify
Check if Vulnerable:
Check Strapi version: if between 5.0.0 and 5.5.1 inclusive, the system is vulnerable.Check Version:
npm list strapi | grep strapiVerify Fix Applied:
Confirm Strapi version is 5.5.2 or higher and test that lookup operator queries no longer expose private fields.📡 Detection & Monitoring
Log Indicators:
- Unusual API requests with lookup parameters
- Multiple failed authentication attempts following lookup queries
Network Indicators:
- HTTP requests containing 'lookup' parameter with unusual field names
- Spike in API requests to document service endpoints
SIEM Query:
source="strapi" AND (lookup OR "$lookup") AND (password OR token OR private)