CVE-2023-22894

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2023-22894 4.9

Strapi · Strapi · Added 2026-10-08 · Published 2023-04-19

3-Day Required PoC Available KEV Active Exploitation

Details

VulnerabilityStrapi Cleartext Storage of Sensitive Information Vulnerability

VendorStrapi

ProductStrapi

Date added2026-10-08

Due date2026-10-11

CISA catalogView on CISA KEV catalog

Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

CWECWE-312

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Descriptions

KEV: Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.

NVD: Strapi through 4.5.5 allows attackers (with access to the admin panel) to discover sensitive user details by exploiting the query filter. The attacker can filter users by columns that contain sensitive information and infer a value from API responses. If the attacker has super admin access, then this can be exploited to discover the password hash and password reset token of all users. If the attacker has admin panel access to an account with permission to access the username and email of API users with a lower privileged role (e.g., Editor or Author), then this can be exploited to discover sensitive information for all API users but not other admin accounts.

Compliance SSVC + BOD 26-04

Automatableno

Technical impacttotal

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days + forensic

Non-public timeline14 days

Forensic (public)Required

Forensic (non-public)Not required

Research metadata

Last researched2026-10-08 20:03 UTC

Wall time0.6s

Searches12

Component defaultyes — query filtering ($and, $startsWith, etc.) is core Strapi REST API functionality present in every deployment, and Strapi automatically creates created_by_id/updated_by_id columns plus the createdBy relation on every content type; exploitation via the unauthenticated vector additionally needs a collection with public find permission

Sources https://nvd.nist.gov/vuln/detail/CVE-2023-22894
https://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8
https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
https://github.com/strapi/strapi/releases/tag/v4.8.0
https://www.ghostccamm.com/blog/multi_strapi_vulns/
https://github.com/Saboor-Hakimi/CVE-2023-22894
https://github.com/maxntv/CVE-2023-22894-PoC
https://docs.strapi.io/dev-docs/api/rest/filters-locale-publication

QC notes

info precondition_contradiction: Preconditions don't mention deployment applicability (component/product version)

warn component_extraction: Component 'Strapi core API query filtering: the `filters` query parameter ($and/$startsWith operators) applied to private user columns (password, reset_password_token) — on admin routes /admin/users and /content-manager/collection-types/plugin::users-permissions.user, and on public /api/* routes via the auto-created createdBy relation' matches or contains product name 'Strapi' — no specific component identified

Hunting hypothesis agent

Hunt access logs for GET requests carrying filters[$and][0][createdBy][password][$startsWith]= prefixes on Strapi /api/* routes — the query-filter leak that brute-forces private password hashes and reset tokens char by char.

Research details

ComponentStrapi core API query filtering: the `filters` query parameter ($and/$startsWith operators) applied to private user columns (password, reset_password_token) — on admin routes /admin/users and /content-manager/collection-types/plugin::users-permissions.user, and on public /api/* routes via the auto-created createdBy relation

PreconditionsVendor-advisory range Strapi >=3.2.1, <4.8.0 (3.x is EOL, unpatched). Unauthenticated (GHSA CVSS PR:N): network access to the HTTP API plus a publicly readable collection whose entries map to users through the auto-created createdBy relation — no special configuration beyond granting public find permission (PR:N, contrary to the KEV/NVD PR:H framing). The admin-panel vector (NVD CVSS 4.9 PR:H) requires a logged-in admin session: super admin for /admin/users, or a lower-privileged admin granted users-permissions read on API users. No user interaction. agent

DeliveryUnauthenticated HTTP GET query strings to Strapi content API routes (e.g. /api/articles?filters[$and][0][createdBy][password][$startsWith]=$2a...) or admin-session requests to /admin/users and /content-manager/collection-types/plugin::users-permissions.user; no special headers or body — the entire payload rides in the filters query parameter, so it lands in default access logs.

Public PoCyes

PoC URLs https://github.com/Saboor-Hakimi/CVE-2023-22894
https://github.com/maxntv/CVE-2023-22894-PoC Third-party repos; verify before use.

Advisoryhttps://github.com/strapi/strapi/security/advisories/GHSA-jjqf-j4w7-92w8

Exploit notesPublic PoCs are functional Python exploit scripts (not detection-only): an unauthenticated dumper that brute-forces field values character-by-character with 20 threads via GET filters[$and][0][createdBy][password][$startsWith]= on a public endpoint related to users, plus an authenticated variant that logs into /admin/login first. The payload rides entirely in the GET query string, so default access logs capture it — the vendor IoC regex matches filter keys [email|password|reset_password_token|resetPasswordToken]. Chaining with CVE-2023-22621 (SSTI in users-permissions email templates, installed by default) yields unauthenticated RCE on Strapi <=4.5.5. NVD rates the admin-panel vector PR:H/CVSS 4.9; the vendor GHSA and researcher demonstrate unauthenticated PR:N/CVSS 7.5.

SummaryStrapi before 4.8.0 (>=3.2.1) leaks private user fields — password hashes and password reset tokens — because the REST API's `filters` query parameter was applied to private columns before they were redacted from responses, letting an attacker infer values from response changes. An unauthenticated attacker can exploit any deployment through the auto-created createdBy relation on publicly readable collections, or an admin-panel user via /admin/users and /content-manager, and chain it with CVE-2023-22621 for unauthenticated RCE on <=4.5.5. Strapi patched it in 4.8.0 (2023-03-15); two functional public Python PoCs exist.

Tia coverage

First reported2026-10-08

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cisa-adds-five-exploited-vulnerabilities-to-kev-catalog

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.