CVE-2022-32114Strapi · Strapi
Vulnerability data via NVD (ingested)
An unrestricted file upload vulnerability in the Add New Assets function of Strapi 4.1.12 allows attackers to conduct XSS attacks via a crafted PDF file. NOTE: the project documentation suggests that a user with the Media Library "Create (upload)" permission is supposed to be able to upload PDF files containing JavaScript, and that all files in a public assets folder are accessible to the outside world (unless the filename begins with a dot character). The administrator can choose to allow only image, video, and audio files (i.e., not PDF) if desired.
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
vuln:CVE-2022-32114product:"Strapi Strapi" version:"4.1.12"http.html:"Strapi"More intel sources (5)
vuln:CVE-2022-32114vulnerabilities.cve_id: CVE-2022-32114CVE-2022-32114CVE-2022-32114"CVE-2022-32114" exploit -site:nvd.nist.gov