Strapi Server-Side Request Forgery (SSRF)

Description

Strapi v4.24.4 was discovered to contain a Server-Side Request Forgery (SSRF) via the component /strapi.io/_next/image. This vulnerability allows attackers to scan for open ports or access sensitive information via a crafted GET request.

Recommendation

No fix is available yet. Followings are affected versions:

• = 4.24.4

References

• GHSA-p9ff-j98v-p435
• medium.com
• strapi.io
• CVE-2024-37818
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Nuxt Icon affected by a Server-Side Request Forgery (SSRF) - CVE-2024-42352
• Strapi allows Server-Side Request Forgery in Webhook function - CVE-2024-52588
• RSSHub vulnerable to Server-Side Request Forgery - CVE-2024-27927
• pdfmake is vulnerable to server-side request forgery (SSRF) - CVE-2026-26801

You might also like:

CSRF, XXE, and 12 Other Security Acronyms Explained

Exploiting Server Version Disclosure

Update Cheat Sheet for Developers

Tags:

npm

@strapi/strapi