Strapi admin leaks password hashes, exploited (CVE-2023-22894) [PoC]

Actively exploited in the wild - CVE-2023-22894 is a high-severity information disclosure flaw in Strapi through 4.5.5 that lets any authenticated admin panel user leak sensitive data, including password hashes and password reset tokens, by abusing query filters on hidden user fields. Strapi patched the issue in 4.6.0; upgrade immediately.

Overview

Strapi is a widely used open source headless CMS, frequently deployed as the backend for content APIs and internal dashboards. CVE-2023-22894 (CVSS 7.2) abuses the admin panel’s query filter feature. Normally, Strapi hides sensitive columns such as password, resetPasswordToken, and resetPasswordTokenExpiration from API responses. The flaw lets an authenticated admin filter users by those hidden columns and infer their values one character at a time through response differences.

The practical effect is a blind extraction primitive. An attacker armed with any admin account can slowly reconstruct secrets that should never leave the database.

Attack requirements are modest: network access, no user interaction, and an authenticated admin session. A super admin can extract the password hash and reset token of every user, including other super admins. A lower-privileged admin who can read the username and email of API users (Editor, Author, etc.) can extract sensitive records for those accounts, though not for other admin accounts. Because Strapi hashes are bcrypt, offline cracking is slow, but password reset tokens are directly usable to hijack accounts, and the same filter logic may expose other hidden fields depending on the schema.

CISA has added this CVE to its Known Exploited Vulnerabilities catalog, confirming real-world use. The EPSS score is 1.7% for the next 30 days, which is high for a niche CMS target and consistent with automated exploitation against internet-exposed admin panels.

Impact

• Super admin compromise escalates to full platform takeover.
• Password hashes enable offline cracking; reset tokens enable immediate account takeover if reused or intercepted.
• Exfiltration is slow and blends into normal admin API traffic, making detection difficult.
• Affected deployments include any Strapi instance through 4.5.5 with an exposed or weakly protected admin panel.

Remediation

1. Update Strapi to 4.6.0 or later. This is the only complete fix; no configuration toggle fully closes the filter primitive.
2. Rotate credentials. After patching, force a password reset for all admin users and invalidate all existing reset tokens. Assume any token in the database during the exposure window is compromised.
3. Audit admin accounts. Remove unused admin users, enforce least privilege, and restrict who can read API user records.
4. Reduce exposure. Place the admin panel behind VPN or IP allowlisting, enable MFA, and monitor /admin and /api/users endpoints for abnormal filter query patterns.

Organizations should also review breach reports for related incidents and track follow-up coverage in security news.

Security Insight

This CVE is a textbook example of a filter API becoming an oracle. Blind extraction through legitimate query parameters is hard to detect because every request looks like normal admin usage, and Strapi is far from alone: similar inference issues have appeared in GraphQL resolvers, Elasticsearch, and NoSQL query layers. The lesson is that any endpoint allowing arbitrary or user-controlled field filtering must assume the filter itself is an attack surface, and validation must reject hidden fields by name, not merely omit them from the response.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs