Package Instance

HTTP 200 OK
Allow: GET, HEAD, OPTIONS
Content-Type: application/json
Vary: Accept

{
    "url": "http://public2.vulnerablecode.io/api/packages/67608?format=api",
    "purl": "pkg:npm/%40strapi/strapi@4.13.1",
    "type": "npm",
    "namespace": "@strapi",
    "name": "strapi",
    "version": "4.13.1",
    "qualifiers": {},
    "subpath": "",
    "is_vulnerable": false,
    "next_non_vulnerable_version": "5.24.1",
    "latest_non_vulnerable_version": "5.24.1",
    "affected_by_vulnerabilities": [],
    "fixing_vulnerabilities": [
        {
            "url": "http://public2.vulnerablecode.io/api/vulnerabilities/46333?format=api",
            "vulnerability_id": "VCID-jpqv-dukr-fyhu",
            "summary": "Unauthorized Access to Private Fields in User Registration API\n### System Details\n| Name   | Value         |\n|----------|------------------------|\n| OS    | Windows 11       |\n| Version | 4.11.1 (node v16.14.2) |\n| Database | mysql         |\n\n\n### Description\nI marked some fields as private fields in user content-type, and tried to register as a new user via api, at the same time I added content to fill the private fields and sent a post request, and as you can see from the images below, I can write to the private fields. To prevent this, I went to the extension area and tried to extend the register method, for this I wanted to do it using the sanitizeInput function that I know in the source codes of the strap. But the sanitizeInput function does not filter out private fields.\n\n```js\n const { auth } = ctx.state;\n const data = ctx.request.body;\n const userSchema = strapi.getModel(\"plugin::users-permissions.user\");\n\n sanitize.contentAPI.input(data, userSchema, { auth });\n```\n\nhere's the solution I've temporarily kept to myself, code snippet\n\n```js\n const body = ctx.request.body;\n\n const { attributes } = strapi.getModel(\"plugin::users-permissions.user\");\n\n const sanitizedData = _.omitBy(body, (data, key) => {\n  const attribute = attributes[key];\n\n  if (_.isNil(attribute)) {\n   return false;\n  }\n\n  //? If you want, you can throw an error for fields that we does not expect.\n\n  // if (_.isNil(attribute))\n  //  throw new ApplicationError(`Unexpected value ${key}`);\n\n  // if private value is true, we do not want to send it to the database.\n  return attribute.private;\n });\n\n return sanitizedData;\n```",
            "references": [
                {
                    "reference_url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023",
                    "reference_id": "",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023"
                },
                {
                    "reference_url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39345",
                    "reference_id": "CVE-2023-39345",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-39345"
                },
                {
                    "reference_url": "https://github.com/advisories/GHSA-gc7p-j5xm-xxh2",
                    "reference_id": "GHSA-gc7p-j5xm-xxh2",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/advisories/GHSA-gc7p-j5xm-xxh2"
                },
                {
                    "reference_url": "https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2",
                    "reference_id": "GHSA-gc7p-j5xm-xxh2",
                    "reference_type": "",
                    "scores": [],
                    "url": "https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2"
                }
            ],
            "fixed_packages": [
                {
                    "url": "http://public2.vulnerablecode.io/api/packages/67608?format=api",
                    "purl": "pkg:npm/%40strapi/strapi@4.13.1",
                    "is_vulnerable": false,
                    "affected_by_vulnerabilities": [],
                    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.13.1"
                }
            ],
            "aliases": [
                "CVE-2023-39345",
                "GHSA-gc7p-j5xm-xxh2"
            ],
            "risk_score": null,
            "exploitability": null,
            "weighted_severity": null,
            "resource_url": "http://public2.vulnerablecode.io/vulnerabilities/VCID-jpqv-dukr-fyhu"
        }
    ],
    "risk_score": null,
    "resource_url": "http://public2.vulnerablecode.io/packages/pkg:npm/%2540strapi/strapi@4.13.1"
}