CVE-2022-0764: Command injection in strapi

Background

Strapi is an open-source headless CMS (Content Management System) that enables developers to build powerful APIs quickly. It provides a flexible and customizable admin panel for managing content. The vulnerability in question allows for command injection when creating a Strapi app using the npx create-strapi-app command. This vulnerability arises due to improper sanitization of user input in the template CLI argument.

Vulnerability Detail

The command injection vulnerability in Strapi allows an attacker to execute arbitrary commands during the creation of a Strapi app. By injecting malicious commands through the template CLI argument, an attacker can potentially gain unauthorized access, escalate privileges, or perform other malicious activities on the affected system. This vulnerability poses a moderate risk and has a CVSS score of 6.1.

npm install strapi@3.6.11

npm install strapi@4.1.0

Workaround

As a temporary workaround, users can manually sanitize the template CLI argument by ensuring that only valid and expected values are provided. This can be done by validating and sanitizing user input before passing it to the npx create-strapi-app command. Here is an example of how to sanitize the template CLI argument in Node.js:

const { exec } = require('child_process');

function sanitizeTemplate(template) {
  // Validate and sanitize the template value
  const sanitizedTemplate = template.replace(/[^a-zA-Z0-9-]/g, '');
  return sanitizedTemplate;
}

const template = sanitizeTemplate(userInput);
exec(`npx create-strapi-app --template ${template}`, (error, stdout, stderr) => {
  // Handle the command execution result
});

Conclusion

In conclusion, the command injection vulnerability in Strapi allows for the execution of arbitrary commands during the creation of a Strapi app. It is crucial to update the Strapi package to version 4.1.0 or later to mitigate this vulnerability. For further support on vulnerability remediation, contact DevNack.com.

See every vulnerability recorded for strapi →

FAQ