CVE-2022-30618: 
JavaScript vulnerability analysis and mitigation

CVE-2022-30618 is a vulnerability discovered in Strapi, a popular open source headless CMS tool built in JavaScript. The vulnerability affects Strapi v3 up to v3.6.9 and Strapi v4 up to v4.1.9, and was disclosed in November 2021. This security flaw allows authenticated users with access to the Strapi admin panel to view private and sensitive data of API users through JSON responses (Synopsys Blog).

The vulnerability has been assigned a CVSS 3.1 base score of 7.5 (High) with the vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C. It is classified as CWE-212, which relates to improper handling of sensitive data exposure. The issue occurs when content types accessible to authenticated users contain relationships to API users, allowing sensitive information such as email and password reset tokens to leak in JSON responses within the admin panel (Synopsys Blog, NVD CWE).

In a worst-case scenario, a low-privileged user could gain access to a high-privileged API account, enabling them to read and modify any data as well as block access to both the admin panel and API by revoking privileges for all other users. The vulnerability could lead to complete account compromise if the password reset API endpoints have been enabled (Synopsys Blog, The Record).

Users are advised to upgrade to patched versions: Strapi v3 users should upgrade to v3.6.10 or later, while Strapi v4 users should upgrade to v4.1.10 or later. The fixes were released on May 11, 2022, addressing the vulnerability in both version branches (Synopsys Blog).

The vulnerability was discovered by David Johansson, principal security consultant at Synopsys Software Integrity Group. The Strapi team was commended for their responsiveness and timely addressing of the vulnerability. With Strapi having nearly 40,000 weekly downloads on NPM for its latest release and being used by major organizations including IBM, Walmart, NASA, and Societe Generale, the impact of this vulnerability was significant (The Record).