CVE report
CVE-2023-22621high
Strapi Versions <=4.5.5 - SSTI to Remote Code Execution
Events 90d
9,121
Distinct IPs
323
Severity
high
CISA KEV
Not listed
Detection signature
An event counts toward CVE-2023-22621 when its URL path contains any of these (case-insensitive). This is what our matching is based on.
- · /admin/login
- · /api/auth/local/register
- · /users-permissions/advanced
- · /users-permissions/email-templates
Pre-disclosure activity
all early actors →Analysing probe history around the publication date…
Recent probe volume (last 7 days)
peak: 278 events/dayeventsdistinct IPs
Downloads & integrations
Top sources probing for CVE-2023-22621
- 88.214.25.13464 eventsGermany· Layer7 Networks GmbH
- 88.214.25.13760 eventsGermany· Layer7 Networks GmbH
- 216.180.246.12660 eventsUnited States
- 88.214.25.13060 eventsGermany· Layer7 Networks GmbH
- 88.214.25.13157 eventsGermany· Layer7 Networks GmbH
- 88.214.25.13854 eventsGermany· Layer7 Networks GmbH
- 216.180.246.23650 eventsUnited States
- 88.214.25.13549 eventsGermany· Layer7 Networks GmbH
- 62.210.142.16347 eventsFrance
- 216.180.246.5447 eventsUnited States
- 216.180.246.22646 eventsUnited States
- 216.180.246.1946 eventsUnited States
- 62.210.142.17746 eventsFrance
- 216.180.246.4046 eventsUnited States
- 88.214.25.13645 eventsGermany· Layer7 Networks GmbH
- 216.180.246.745 eventsUnited States
- 216.180.246.14945 eventsUnited States
- 216.180.246.12445 eventsUnited States
- 216.180.246.21544 eventsUnited States
- 216.180.246.20444 eventsUnited States
- 216.180.246.11643 eventsUnited States
- 216.180.246.7043 eventsUnited States
- 88.214.25.13243 eventsGermany· Layer7 Networks GmbH
- 216.180.246.18743 eventsUnited States
- 62.210.142.16243 eventsFrance
- 216.180.246.13643 eventsUnited States
- 216.180.246.13042 eventsUnited States
- 62.210.142.17442 eventsFrance
- 88.214.25.13342 eventsGermany· Layer7 Networks GmbH
- 62.210.142.17342 eventsFrance
Top networks the attempts come from
- AS396982 Google LLC250 IPs · 7,464 ev
- AS12876 Scaleway S.a.s.32 IPs · 1,088 ev
- AS35042 Layer7 Networks GmbH9 IPs · 474 ev
- AS208137 Feo Prest SRL1 IPs · 31 ev
- AS211590 Bucklog SARL11 IPs · 17 ev
- AS37963 Hangzhou Alibaba Advertising Co.,Ltd.2 IPs · 12 ev
- AS51167 Contabo GmbH2 IPs · 6 ev
- AS43754 Asiatech Data Transmission company2 IPs · 4 ev
- AS32097 WholeSale Internet, Inc.1 IPs · 3 ev
- AS135377 UCLOUD INFORMATION TECHNOLOGY HK LIMITED1 IPs · 3 ev
Fingerprints of the clients exploiting this
The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.
ja4h: ge11nn0400_88d30a62b7adja4h: ge11nn0500_3d22e8e9e6c3ja4h: ge11nn0500_2d30dc89d981ja4h: ge11nn14en_068ebe3632ecja4h: ge11nn06en_c79eadf4d2aaja4h: ge11nn07en_c3a540a630d2ja4: t13i1909h1_9dc949149365_97f8aa674fd9ja4: t13i3111h2_e8f1e7e78f70_8d633dac7124ja4: t13i251000_b78ed14e2fd0_ab7e3b40a677ja4: t13i1113h2_5e2a75874763_89e9e4bb3419ja4: t13i1114h2_5e2a75874763_53a89c02159a
Sample request paths observed
- /admin/login
- /admin/login_login.action
- /admin/login.asp
- /include/thumb.php?dir=http/.....///.....///admin/login/login_check.php
- //admin/login
- /admin/login/index.php
- /admin/login.php
- /admin/login/
- /admin/login%2eenv
- /admin/login/?next=/admin/