GHSA-p9ff-j98v-p435

Strapi Server-Side Request Forgery (SSRF)

At a glance

Published: 2024-06-20 21:31 UTC
Updated: 2024-10-04 23:57 UTC
CVE: CVE-2024-37818
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Description

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request.

Affected packages

Package	Versions
npm · @strapi/strapi	4.24.4

References

https://nvd.nist.gov/vuln/detail/CVE-2024-37818 ADVISORY
https://github.com/strapi/strapi PACKAGE
https://medium.com/%40barkadevaibhav491/server-side-request-forgery-in-strapi-e02d5fe218ab WEB
https://strapi.io WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database