Package Instance

Weak Password Recovery Mechanism for Forgotten Password
strapi mishandles password resets within `packages/strapi-admin/controllers/Auth.js` and `packages/strapi-plugin-users-permissions/controllers/Auth.js`.

Weak Password Recovery Mechanism for Forgotten Password
In Strapi, the admin panel allows the changing of one's own password without entering the current password. An attacker who gains access to a valid session can use this to take over an account by changing the password.

Duplicate Advisory: OS Command Injection in Strapi
### Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9p2w-rmx4-9mw7. This link is maintained to preserve external references.

### Original Description
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.

Command injection in strapi
Arbitrary Command Injection in GitHub repository strapi/strapi prior to 4.1.0.

Improper Input Validation
Strapi could allow a remote authenticated attacker to bypass security restrictions because templates are stored in a global variable without any sanitation. By sending a specially crafted request, an attacker could exploit this vulnerability to update the email template for both password reset and account confirmation emails.

Incorrect Default Permissions
In Strapi, there is no `admin::hasPermissions` restriction for CTB (aka content-type-builder) routes.

Command Injection in strapi
Versions of `strapi` before 3.0.0-beta.17.8 are vulnerable to Command Injection. The package fails to sanitize plugin names in the `/admin/plugins/install/` route. This may allow an authenticated attacker with admin privileges to run arbitrary commands in the server.

Improper Input Validation
`admin/src/containers/InputModalStepperProvider/index.js` in Strapi has unwanted `/proxy?url=` functionality.

Uncontrolled Resource Consumption
A denial of service exists in strapi v3.0.0-beta.18.3 and earlier that can be abused in the admin console using admin rights can lead to arbitrary restart of the application.

Cross-site Scripting
Strapi has stored XSS in the wysiwyg editor's preview feature.