GHSA-495j-h493-42q2
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Quick fix
GHSA-495j-h493-42q2 — @strapi/core: upgrade to the fixed version with the command below.
npm install @strapi/core@5.5.2Details
### Summary It's possible to access any private fields by filtering through the lookup parameters
### Details
Using the new lookup operator provided by the document service in Strapi 5, it is not properly sanitizing this query operator for private fields.
### PoC
1. Create a strapi app. 2. Create a content-type 3. In the content-type you make a new entry 4. Go back to the list view 4. Add `&lookup[updatedBy][password][$startsWith]=$2` to the end of your url (All passwords start with $2) see that all entries are still there 6. Add `&lookup[updatedBy][password][$startsWith]=$3` see the entry disappear proving that the search above works
### Impact
An attacker can perform filtering attacks on everything related to the object, including admin passwords and reset-tokens. This means that they can gain full access to the strapi instance.
Are you affected?
Enter the version of the package you're using.