high7.2Public exploit code
CVE-2019-19609
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because i…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Strapi 3.0.0-beta.17.7 - Remote Code Execution (RCE) (Authenticated)2021-08-30 · webapps · multiple
Impact
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Strapi | Strapi | through 1.6.4 Version 3.0.0 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
- https://bittherapy.net/post/strapi-framework-remote-code-execution/
- https://github.com/strapi/strapi/pull/4636
- http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
- https://bittherapy.net/post/strapi-framework-remote-code-execution/
- https://github.com/strapi/strapi/pull/4636