CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability
Strapi contains a cleartext storage of sensitive information vulnerability that could allow attackers with access to the admin panel to discover sensitive user details via the query filter. The impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. This vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Overview
Strapi versions from 3.2.1 up to 4.8.0 contain a cleartext storage flaw that exposes sensitive user fields through the admin panel's query filter API. An attacker with admin panel access can craft filter parameters targeting private database columns, such as password hashes and password reset tokens, and infer their values from the API responses. CISA notes this vulnerability can be chained with CVE-2023-22621 to achieve remote code execution.
Vulnerability details
Strapi fails to restrict which user-table columns are available as filter targets in its admin API. Sensitive fields, including password hashes and password reset tokens, are stored in a way that makes them reachable through the query filter interface rather than being excluded from it. An attacker can enumerate these private fields column by column, submitting successive filter queries and reading the API responses to infer the stored values. This is the core of CWE-312: sensitive data is retained in a form that an authorized-but-not-fully-trusted actor can extract through a legitimate-looking interface.
An attacker with super admin access can extract password hashes and password reset tokens for every user account. An attacker with a lower-privileged admin account, one with permission to view API user records, can recover usernames and emails for those users but not for other admin accounts. The attack path is inbound: the attacker sends crafted filter parameters to the admin panel API, reads the responses, and iterates until the target field value is reconstructed. Password reset tokens obtained this way can be used to hijack admin accounts, and CISA notes that chaining this with CVE-2023-22621 allows an unauthenticated attacker to achieve remote code execution.
Severity and impact
Exploitation status
This vulnerability is confirmed as actively exploited in the wild — it is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
Detection and monitoring
- Review Strapi access logs for repeated GET requests to admin user-listing or user-filter API endpoints from a single authenticated session, particularly requests that vary only in filter parameter values across many sequential calls, which indicates enumeration of private fields.
- Audit admin panel authentication logs for accounts accessing user data at volumes or frequencies inconsistent with normal administrative activity, especially sessions that query user records without corresponding content-management actions.
- Check for unexpected password reset events or admin account takeovers shortly after periods of high-volume admin API filter activity, which may indicate that a harvested reset token was used to hijack an account.
Remediation
Additional hardening
- Upgrade Strapi to version 4.8.0 or later, where filtering on private user fields is restricted. Strapi 3.x reached end of life on December 31, 2022, and will not receive security updates; migration to a supported 4.x release is required.
- Restrict admin panel access to trusted IP ranges using a reverse proxy or firewall rule, reducing the pool of accounts that could submit crafted filter queries even if credentials are compromised.
- Audit all admin panel accounts and remove or downgrade any accounts whose roles grant user-data access beyond operational need, applying least-privilege principles to limit the fields an attacker could reach with a given credential.
- If immediate upgrade is not possible, monitor for and rotate all admin account password reset tokens, and treat any existing tokens as potentially compromised if the instance was exposed while running an affected version.
Key dates
References
- https://github.com/strapi/strapi/releases
- https://strapi.io/blog/security-disclosure-of-vulnerabilities-cve
- https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk
- https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk
- https://nvd.nist.gov/vuln/detail/CVE-2023-22894
- https://www.ghostccamm.com/blog/multi_strapi_vulns/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-22894
Frequently asked questions
Does CVE-2023-22894 affect my FedRAMP authorization?
If Strapi runs inside your authorization boundary, yes. CVE-2023-22894 appears on CISA's Known Exploited Vulnerabilities (KEV) catalog, and its remediation deadline of October 11, 2026 has already passed. For a FedRAMP-authorized service, an unpatched KEV in your boundary is an assessor finding. An overdue one is a finding your assessor and sponsoring agency can already see. Your options now are to remediate it or formally document the mitigation and the delay.
How does Knox help me handle CVE-2023-22894?
Knox does not patch your Strapi instance. Under the FedRAMP shared-responsibility model, that remediation belongs to you. What Knox provides is the pre-authorized, single-tenant boundary to remediate within, along with continuous compliance monitoring and audit-artifact coverage that document the fix for your next assessment. The work of applying the patch is yours; maintaining a defensible compliance posture while you do it is not something you have to manage on your own.
How does Knox's monitoring help with vulnerabilities like this?
Knox's automated continuous monitoring platform watches your environment for newly disclosed vulnerabilities and compliance issues on a continuous basis. For a CVE like CVE-2023-22894, that means exposure surfaces during ongoing monitoring rather than only when an assessor flags it at review time, giving you a shorter window between disclosure and response.
How do I get FedRAMP authorized with Knox?
Knox runs a FedRAMP-as-a-Service platform. It gives SaaS vendors a pre-authorized cloud boundary on AWS, Azure, and GCP. Your application inherits 60-80% of the required security controls. You reach FedRAMP authorization in about 90 days for roughly 90% less than the traditional $3.5M path. Book a meeting and Knox will map your path to authorization.
CVE-2023-22894's remediation deadline of October 11, 2026 has passed. What happens now?
If CVE-2023-22894 remains unremediated, it sits as a Plan of Action and Milestones (POA&M) item on your record now. A growing POA&M list is what turns a routine continuous-monitoring review into a difficult conversation with your sponsoring agency. Closing the finding and documenting why the deadline was missed is what keeps your authorization clean and the agency relationship intact.
Access continuous compliance
We never compromise on security. Meet with our team to discuss scope, readiness, and map your company’s accelerated path to government certification.
_Horizontal_RGB.png)
