CVE-2024-34065: @strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass

June 12, 2024

By combining two vulnerabilities (an Open Redirect and session token sent as URL query parameter) in Strapi framework is its possible of an unauthenticated attacker to bypass authentication mechanisms and retrieve the 3rd party tokens. The attack requires user interaction (one click).

References

github.com/advisories/GHSA-wrvh-rcmr-9qfc
github.com/strapi/strapi
github.com/strapi/strapi/commit/9c79921d22142a5de77ea26151550a14e4b12669
github.com/strapi/strapi/security/advisories/GHSA-wrvh-rcmr-9qfc
nvd.nist.gov/vuln/detail/CVE-2024-34065

Code Behaviors & Features

Detect and mitigate CVE-2024-34065 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →