Strapi CVE-2023-22894: Query Filter Secrets Leak Enables RCE Chaining

High-privileged admin panel access in Strapi versions 3.2.1 through 4.7.x carries a hidden danger that extends beyond standard role boundaries. A cleartext storage of sensitive information vulnerability in Strapi, tracked as CVE-2023-22894, enables users with admin panel access to query and extract sensitive system fields that should remain strictly protected. While its standalone CVSS 3.1 score of 4.9 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N) rates as Medium severity due to requiring elevated privileges, the real-world operational risk escalates dramatically when combined with secondary application flaws.

Specifically, CVE-2023-22894 serves as an ideal initial staging primitive, allowing attackers to chain this disclosure with CVE-2023-22621 to achieve full remote code execution (RCE) on the underlying host.

Exploiting the Query Filter Leak

The underlying weakness stems from improper field sanitization within Strapi’s admin panel API query parser (CWE-312). In affected releases prior to version 4.8.0, the query engines powering administrative views fail to properly sanitize filtering logic against internal user and system attributes.

An authenticated attacker with access to the admin panel—or a threat actor who has hijacked an administrative session—can construct crafted API filter queries against endpoints such as /admin/users or /api/users. By leveraging operators like $contains, $startsWith, or regular expression matches inside request parameters, an attacker can iteratively dump restricted database fields, including:

• Password reset tokens and password hashes for other administrative users.
• Internal API keys, session secrets, and application tokens.
• Restricted user metadata and configuration secrets stored in cleartext.

Because the attack complexity is low (AC:L) and requires no user interaction (UI:N), automated scripts can rapidly exfiltrate sensitive attributes once an administrative session token is obtained.

The Exploit Chain to Remote Code Execution

In isolation, a high-privilege information disclosure flaw rarely prompts urgent response cycles. However, headless CMS platforms like Strapi are heavily targeted by threat actors looking for rapid footprint expansion into cloud environments.

When CVE-2023-22894 is leveraged alongside CVE-2023-22621, the impact shifts from local data exposure to total host compromise. Exfiltrating administrative tokens, reset keys, or internal secrets via the query filter leak provides the precise state data needed to trigger execution under CVE-2023-22621. Once executed, the attacker gains arbitrary code execution inside the Node.js application container, paving the way for credential dumping, environment variable theft, and lateral movement.

This potential for multi-vulnerability chaining is why CVE-2023-22894 carries an EPSS score of 1.7% (placing it in the 75.9th percentile of scored vulnerabilities). Security teams should not let the high privilege requirement obscure the threat; stolen administrative JWTs and compromised API credentials are among the most common artifacts observed in modern web application intrusions.

Specific Remediation and Controls

To resolve this issue, operators must upgrade all Strapi deployments to version 4.8.0 or higher, where field filtering on administrative routes is properly restricted.

Organizations maintaining Strapi instances should execute the following defensive actions:

• Upgrade Deployment: Update strapi dependencies in package.json to version >=4.8.0 and rebuild application admin panels.
• Inspect Web Access Logs: Query HTTP request logs for traffic hitting /admin/users or /api/users containing filter strings such as filters[resetPasswordToken] or filters[password].
• Secret Rotation: If an instance was exposed publicly on an vulnerable version, immediately rotate the ADMIN_JWT_SECRET, API tokens, and database credentials configured in the application environment variables.