CVE-2023-22894 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: MEDIUM

Exploitation Method: DIRECT_NETWORK

CVE Published: 2023-04-19

Added to CISA KEV: 2026-10-08 1268 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

⚠️ CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review logs, check for unauthorized access, verify system integrity before patching
PATCH IMMEDIATELY: Upgrade Strapi to a version above 4.5.5. Review the official Strapi security advisory at strapi.io/blog/security-disclosure-of-vulnerabilities-cve for the specific patched release.
AUDIT ADMIN ACCOUNTS: Review all admin panel accounts for signs of unauthorized access. Check whether any accounts were created or modified unexpectedly around and after April 2023.
ROTATE ALL CREDENTIALS: Assume password hashes and reset tokens may have been exfiltrated if the admin panel was internet-accessible while running a vulnerable version. Force password resets for all users. Rotate API keys and secrets stored in Strapi.
RESTRICT ADMIN PANEL ACCESS: Place the Strapi admin panel behind a VPN, IP allowlist, or private network segment. There is no legitimate reason for the admin panel to be publicly accessible — only the content API endpoints need to be public.
REVIEW SERVER LOGS: Search HTTP access logs for suspicious GET parameters containing filter conditions targeting sensitive columns (e.g., 'password', 'resetPasswordToken', 'email'). These would appear as crafted query strings in requests to admin API endpoints.
ENABLE MFA: If Strapi's version supports it, or via SSO integration, enable multi-factor authentication for admin panel access to reduce the risk of credential-based initial access.
MONITOR FOR ACCOUNT TAKEOVER: Given that reset tokens may have been leaked, monitor for unusual password reset activity, new admin account creation, or unexpected content changes in the CMS.
PATCH PRIORITY: HIGH for internet-facing Strapi instances running ≤4.5.5 with admin panel exposed. MEDIUM for instances behind VPN/private network. Apply within 72 hours for exposed instances.

🔍 Web Intelligence (Kagi · 2026-10-08)

Summary

CVE-2023-22894 is an information disclosure vulnerability affecting the Strapi headless content management system, specifically versions up to and including 4.5.5. The vulnerability exists within the application's query filter mechanism, which fails to properly restrict access to private fields when querying the database. This allows an attacker to exploit the filter functionality to infer and retrieve sensitive user information—such as email addresses, password hashes, and password reset tokens—from the API responses, posing a significant risk to user data confidentiality and account security.

Exploitation

Active Exploitation: While the vulnerability was disclosed in April 2023, there is no widely publicized evidence of large-scale, automated ransomware campaigns specifically targeting this CVE in the wild.
PoC Availability: Proof-of-concept (PoC) exploit scripts are available on public repositories, such as GitHub, demonstrating how to leverage the filtering functionality to leak sensitive fields.
Attack Prerequisites:

- Authentication: While initial reports suggested it required admin panel access, subsequent advisories have indicated that in certain configurations, it can be exploited by unauthenticated attackers to target administrative and API user details. - Interaction: No user interaction is required from the victims. - Complexity: Exploitation is relatively straightforward and can be conducted by injecting crafted GET parameters into API requests.

Detection: The exploit is considered easily detectable because the malicious payloads are typically visible within GET parameters and are often captured in standard server request logs.

Affected Products & Patches

Affected Versions: Strapi CMS versions up to and including 4.5.5 are affected.
Patch/Hotfix Availability: The vendor addressed this vulnerability in subsequent releases. Users are encouraged to upgrade to the latest stable version of Strapi to remediate the issue.
Mitigation: If an immediate upgrade is not possible, organizations should review and restrict access to the API endpoints that allow user-defined filtering, implement strict input validation, and monitor server logs for suspicious filtering patterns targeting sensitive database columns.

Impact

Data Access: Successful exploitation provides unauthorized access to sensitive user metadata, including credentials (password hashes) and account recovery tokens.
System Compromise: The leakage of password hashes and reset tokens enables attackers to perform credential stuffing or account takeover (ATO) attacks, potentially granting them administrative control over the Strapi instance.
Business Risk: For internet-facing deployments, this vulnerability can lead to a total breach of user data, loss of administrative control over the content management system, and subsequent compromises of the applications or sites powered by the affected Strapi instance.