CVE report

CVE-2023-22621high

Strapi Versions <=4.5.5 - SSTI to Remote Code Execution

Events 90d

9,121

Distinct IPs

323

Severity

high

CISA KEV

Not listed

Detection signature

An event counts toward CVE-2023-22621 when its URL path contains any of these (case-insensitive). This is what our matching is based on.

  • · /admin/login
  • · /api/auth/local/register
  • · /users-permissions/advanced
  • · /users-permissions/email-templates

Pre-disclosure activity

all early actors →

Analysing probe history around the publication date…

Recent probe volume (last 7 days)

peak: 278 events/day
04-2805-1705-3006-1206-2507-0807-2107-27
eventsdistinct IPs

Downloads & integrations

Top sources probing for CVE-2023-22621

Top networks the attempts come from

Fingerprints of the clients exploiting this

The HTTP (JA4H) and TLS (JA4) fingerprints seen on these attempts. Click one to see the whole population that carries it.

Sample request paths observed

  • /admin/login
  • /admin/login_login.action
  • /admin/login.asp
  • /include/thumb.php?dir=http/.....///.....///admin/login/login_check.php
  • //admin/login
  • /admin/login/index.php
  • /admin/login.php
  • /admin/login/
  • /admin/login%2eenv
  • /admin/login/?next=/admin/