A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.
The product does not properly control the allocation and maintenance of a limited resource.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Strapi | Strapi | * | 3.0.0 (excluding) |
| Strapi | Strapi | 3.0.0-alpha10.1 (including) | 3.0.0-alpha10.1 (including) |
| Strapi | Strapi | 3.0.0-alpha10.2 (including) | 3.0.0-alpha10.2 (including) |
| Strapi | Strapi | 3.0.0-alpha10.3 (including) | 3.0.0-alpha10.3 (including) |
| Strapi | Strapi | 3.0.0-alpha11 (including) | 3.0.0-alpha11 (including) |
| Strapi | Strapi | 3.0.0-alpha11.1 (including) | 3.0.0-alpha11.1 (including) |
| Strapi | Strapi | 3.0.0-alpha11.2 (including) | 3.0.0-alpha11.2 (including) |
| Strapi | Strapi | 3.0.0-alpha11.3 (including) | 3.0.0-alpha11.3 (including) |
| Strapi | Strapi | 3.0.0-alpha12 (including) | 3.0.0-alpha12 (including) |
| Strapi | Strapi | 3.0.0-alpha12.1 (including) | 3.0.0-alpha12.1 (including) |
| Strapi | Strapi | 3.0.0-alpha12.1.3 (including) | 3.0.0-alpha12.1.3 (including) |
| Strapi | Strapi | 3.0.0-alpha12.2 (including) | 3.0.0-alpha12.2 (including) |
| Strapi | Strapi | 3.0.0-alpha12.3 (including) | 3.0.0-alpha12.3 (including) |
| Strapi | Strapi | 3.0.0-alpha12.4 (including) | 3.0.0-alpha12.4 (including) |
| Strapi | Strapi | 3.0.0-alpha12.5 (including) | 3.0.0-alpha12.5 (including) |
| Strapi | Strapi | 3.0.0-alpha12.6 (including) | 3.0.0-alpha12.6 (including) |
| Strapi | Strapi | 3.0.0-alpha12.7 (including) | 3.0.0-alpha12.7 (including) |
| Strapi | Strapi | 3.0.0-alpha12.7.1 (including) | 3.0.0-alpha12.7.1 (including) |
| Strapi | Strapi | 3.0.0-alpha13 (including) | 3.0.0-alpha13 (including) |
| Strapi | Strapi | 3.0.0-alpha13.0.1 (including) | 3.0.0-alpha13.0.1 (including) |
| Strapi | Strapi | 3.0.0-alpha13.1 (including) | 3.0.0-alpha13.1 (including) |
| Strapi | Strapi | 3.0.0-alpha14 (including) | 3.0.0-alpha14 (including) |
| Strapi | Strapi | 3.0.0-alpha14.1 (including) | 3.0.0-alpha14.1 (including) |
| Strapi | Strapi | 3.0.0-alpha14.1.1 (including) | 3.0.0-alpha14.1.1 (including) |
| Strapi | Strapi | 3.0.0-alpha14.2 (including) | 3.0.0-alpha14.2 (including) |
| Strapi | Strapi | 3.0.0-alpha14.3 (including) | 3.0.0-alpha14.3 (including) |
| Strapi | Strapi | 3.0.0-alpha14.4.0 (including) | 3.0.0-alpha14.4.0 (including) |
| Strapi | Strapi | 3.0.0-alpha14.5 (including) | 3.0.0-alpha14.5 (including) |
| Strapi | Strapi | 3.0.0-alpha15 (including) | 3.0.0-alpha15 (including) |
| Strapi | Strapi | 3.0.0-alpha16 (including) | 3.0.0-alpha16 (including) |
| Strapi | Strapi | 3.0.0-alpha17 (including) | 3.0.0-alpha17 (including) |
| Strapi | Strapi | 3.0.0-alpha18 (including) | 3.0.0-alpha18 (including) |
| Strapi | Strapi | 3.0.0-alpha19 (including) | 3.0.0-alpha19 (including) |
| Strapi | Strapi | 3.0.0-alpha20 (including) | 3.0.0-alpha20 (including) |
| Strapi | Strapi | 3.0.0-alpha21 (including) | 3.0.0-alpha21 (including) |
| Strapi | Strapi | 3.0.0-alpha22 (including) | 3.0.0-alpha22 (including) |
| Strapi | Strapi | 3.0.0-alpha23 (including) | 3.0.0-alpha23 (including) |
| Strapi | Strapi | 3.0.0-alpha23.1 (including) | 3.0.0-alpha23.1 (including) |
| Strapi | Strapi | 3.0.0-alpha24 (including) | 3.0.0-alpha24 (including) |
| Strapi | Strapi | 3.0.0-alpha24.1 (including) | 3.0.0-alpha24.1 (including) |
| Strapi | Strapi | 3.0.0-alpha25 (including) | 3.0.0-alpha25 (including) |
| Strapi | Strapi | 3.0.0-alpha25.1 (including) | 3.0.0-alpha25.1 (including) |
| Strapi | Strapi | 3.0.0-alpha25.2 (including) | 3.0.0-alpha25.2 (including) |
| Strapi | Strapi | 3.0.0-alpha26 (including) | 3.0.0-alpha26 (including) |
| Strapi | Strapi | 3.0.0-alpha26.1 (including) | 3.0.0-alpha26.1 (including) |
| Strapi | Strapi | 3.0.0-alpha26.2 (including) | 3.0.0-alpha26.2 (including) |
| Strapi | Strapi | 3.0.0-alpha4 (including) | 3.0.0-alpha4 (including) |
| Strapi | Strapi | 3.0.0-alpha4.8 (including) | 3.0.0-alpha4.8 (including) |
| Strapi | Strapi | 3.0.0-alpha5.3 (including) | 3.0.0-alpha5.3 (including) |
| Strapi | Strapi | 3.0.0-alpha5.5 (including) | 3.0.0-alpha5.5 (including) |
| Strapi | Strapi | 3.0.0-alpha6.3 (including) | 3.0.0-alpha6.3 (including) |
| Strapi | Strapi | 3.0.0-alpha6.4 (including) | 3.0.0-alpha6.4 (including) |
| Strapi | Strapi | 3.0.0-alpha6.7 (including) | 3.0.0-alpha6.7 (including) |
| Strapi | Strapi | 3.0.0-alpha7.2 (including) | 3.0.0-alpha7.2 (including) |
| Strapi | Strapi | 3.0.0-alpha7.3 (including) | 3.0.0-alpha7.3 (including) |
| Strapi | Strapi | 3.0.0-alpha8 (including) | 3.0.0-alpha8 (including) |
| Strapi | Strapi | 3.0.0-alpha8.3 (including) | 3.0.0-alpha8.3 (including) |
| Strapi | Strapi | 3.0.0-alpha9 (including) | 3.0.0-alpha9 (including) |
| Strapi | Strapi | 3.0.0-alpha9.1 (including) | 3.0.0-alpha9.1 (including) |
| Strapi | Strapi | 3.0.0-alpha9.2 (including) | 3.0.0-alpha9.2 (including) |
| Strapi | Strapi | 3.0.0-beta0 (including) | 3.0.0-beta0 (including) |
| Strapi | Strapi | 3.0.0-beta1 (including) | 3.0.0-beta1 (including) |
| Strapi | Strapi | 3.0.0-beta10 (including) | 3.0.0-beta10 (including) |
| Strapi | Strapi | 3.0.0-beta11 (including) | 3.0.0-beta11 (including) |
| Strapi | Strapi | 3.0.0-beta12 (including) | 3.0.0-beta12 (including) |
| Strapi | Strapi | 3.0.0-beta13 (including) | 3.0.0-beta13 (including) |
| Strapi | Strapi | 3.0.0-beta14 (including) | 3.0.0-beta14 (including) |
| Strapi | Strapi | 3.0.0-beta15 (including) | 3.0.0-beta15 (including) |
| Strapi | Strapi | 3.0.0-beta16 (including) | 3.0.0-beta16 (including) |
| Strapi | Strapi | 3.0.0-beta16.1 (including) | 3.0.0-beta16.1 (including) |
| Strapi | Strapi | 3.0.0-beta16.2 (including) | 3.0.0-beta16.2 (including) |
| Strapi | Strapi | 3.0.0-beta16.3 (including) | 3.0.0-beta16.3 (including) |
| Strapi | Strapi | 3.0.0-beta16.4 (including) | 3.0.0-beta16.4 (including) |
| Strapi | Strapi | 3.0.0-beta16.5 (including) | 3.0.0-beta16.5 (including) |
| Strapi | Strapi | 3.0.0-beta16.6 (including) | 3.0.0-beta16.6 (including) |
| Strapi | Strapi | 3.0.0-beta16.7 (including) | 3.0.0-beta16.7 (including) |
| Strapi | Strapi | 3.0.0-beta16.8 (including) | 3.0.0-beta16.8 (including) |
| Strapi | Strapi | 3.0.0-beta17 (including) | 3.0.0-beta17 (including) |
| Strapi | Strapi | 3.0.0-beta17.1 (including) | 3.0.0-beta17.1 (including) |
| Strapi | Strapi | 3.0.0-beta17.2 (including) | 3.0.0-beta17.2 (including) |
| Strapi | Strapi | 3.0.0-beta17.3 (including) | 3.0.0-beta17.3 (including) |
| Strapi | Strapi | 3.0.0-beta17.4 (including) | 3.0.0-beta17.4 (including) |
| Strapi | Strapi | 3.0.0-beta17.5 (including) | 3.0.0-beta17.5 (including) |
| Strapi | Strapi | 3.0.0-beta17.6 (including) | 3.0.0-beta17.6 (including) |
| Strapi | Strapi | 3.0.0-beta17.7 (including) | 3.0.0-beta17.7 (including) |
| Strapi | Strapi | 3.0.0-beta17.8 (including) | 3.0.0-beta17.8 (including) |
| Strapi | Strapi | 3.0.0-beta18 (including) | 3.0.0-beta18 (including) |
| Strapi | Strapi | 3.0.0-beta18.1 (including) | 3.0.0-beta18.1 (including) |
| Strapi | Strapi | 3.0.0-beta18.2 (including) | 3.0.0-beta18.2 (including) |
| Strapi | Strapi | 3.0.0-beta18.3 (including) | 3.0.0-beta18.3 (including) |
| Strapi | Strapi | 3.0.0-beta2 (including) | 3.0.0-beta2 (including) |
| Strapi | Strapi | 3.0.0-beta3 (including) | 3.0.0-beta3 (including) |
| Strapi | Strapi | 3.0.0-beta4 (including) | 3.0.0-beta4 (including) |
| Strapi | Strapi | 3.0.0-beta5 (including) | 3.0.0-beta5 (including) |
| Strapi | Strapi | 3.0.0-beta6 (including) | 3.0.0-beta6 (including) |
| Strapi | Strapi | 3.0.0-beta7 (including) | 3.0.0-beta7 (including) |
| Strapi | Strapi | 3.0.0-beta8 (including) | 3.0.0-beta8 (including) |
| Strapi | Strapi | 3.0.0-beta9 (including) | 3.0.0-beta9 (including) |
Mitigation of resource exhaustion attacks requires that the target system either:
The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question.
The second solution is simply difficult to effectively institute – and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.