CVE-2023-22894: Strapi Cleartext Storage of Sensitive Information Vulnerability

CISA's catalog says "Strapi contains a cleartext storage of sensitive information vulnerability"[2]. CISA also says the flaw can be chained with CVE-2023-22621 to achieve remote code execution.[2]The CVE record, as shown by OpenCVE, says that an attacker with super admin access could use the flaw to find the password hash and password reset token of every user.[3]GitHub's advisory says unauthenticated attackers could use the flaw to take over Strapi administrator accounts by leaking the password reset token and changing the admin password[4]. It says this works on all Strapi versions up to and including 4.7.1.[4]In its 2023 disclosure, Strapi told users to "Immediately update your Strapi to version >4.8.0!"[5] The company also said version 3.x.x reached end of life on December 31, 2022, and would not get a patch.[5]Strapi also said that attacks using CVE-2023-22894 are easy to spot because the payload sits in GET parameters, which normally appear in request logs.[6] The Hacker News lists a CVSS score of 7.2[1], while CVE Security reports a CVSS score of 4.9 MEDIUM.[7]According to The Hacker News, CISA's Chris Butera said Chinese government-affiliated actors aim to disrupt "critical functions at a future time of their choosing."[1]