CVE-2020-27665: Improper Authorization in Strapi
Summary
CVE-2020-27665: Improper Authorization in Strapi. Affects strapi-plugin-content-type-builder versions < 3.2.5. Fixed in 3.2.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Strapi is an open-source headless CMS (Content Management System) that provides developers with a set of tools to build, deploy, and manage APIs quickly. It allows users to create and manage content types, define relationships between them, and customize the API endpoints. The Strapi plugin 'strapi-plugin-content-type-builder' is responsible for managing content type creation and modification within the CMS.
Vulnerability Detail
The vulnerability identified as CVE-2020-27665 exists in Strapi versions prior to 3.2.5. It is an improper authorization issue specifically related to the content-type-builder (CTB) routes. The vulnerability arises from the lack of 'admin::hasPermissions' restriction for these routes. This means that an authenticated user with any role can access and modify content types, potentially leading to unauthorized data manipulation and security breaches.
How To Fix
Minimum fixed version
3.2.5
This is the first release that contains the fix.
npm install strapi-plugin-content-type-builder@3.2.5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can manually implement the 'admin::hasPermissions' restriction for CTB routes in their Strapi installation. This can be achieved by modifying the relevant code files to enforce proper authorization checks. Here is an example of how to add the authorization check in the 'routes.json' file:
{
"method": "POST",
"path": "/content-type-builder",
"handler": "content-type-builder.create",
"config": {
"policies": [
"plugins::users-permissions.permissions"
],
"permissions": [
"content-type-builder.create"
]
}
}
In this example, the 'plugins::users-permissions.permissions' policy is added to enforce the necessary permissions for the 'content-type-builder.create' action.
Conclusion
The vulnerability identified as CVE-2020-27665 in Strapi's 'strapi-plugin-content-type-builder' plugin allows unauthorized access and modification of content types. To mitigate this vulnerability, it is crucial to upgrade to Strapi version 3.2.5 or later. Alternatively, users can implement the necessary authorization checks manually. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for strapi-plugin-content-type-builder →
FAQ
This vulnerability allows authenticated users with any role to access and modify content types in Strapi, potentially leading to unauthorized data manipulation and security breaches.
No, only Strapi versions prior to 3.2.5 are affected. It is recommended to upgrade to the latest version to mitigate the vulnerability.
Yes, a workaround is available by manually implementing the necessary authorization checks for CTB routes in the Strapi installation. Please refer to the 'workaround' section for more details.
You can use the Vulert Playground at Vulert Scanner to check if your Strapi installation is affected by this vulnerability. Simply upload your 'package-lock.json' file and the tool will provide real-time alerts for open-source vulnerabilities.
For more information about this vulnerability, you can refer to the official GitHub advisory at https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2020/10/GHSA-4p55-xj37-fx7g/GHSA-4p55-xj37-fx7g.json
