Description
The Strapi framework before 3.0.0-beta.17.8 is vulnerable to Remote Code Execution in the Install and Uninstall Plugin components of the Admin panel, because it does not sanitize the plugin name, and attackers can inject arbitrary shell commands to be executed by the execa function.
Remediation
References
http://packetstormsecurity.com/files/163940/Strapi-3.0.0-beta.17.7-Remote-Code-Execution.html
http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html
https://bittherapy.net/post/strapi-framework-remote-code-execution/
https://github.com/strapi/strapi/pull/4636
Related Vulnerabilities
CVE-2020-23811 Vulnerability in maven package com.xuxueli:xxl-job
CVE-2017-17068 Vulnerability in maven package org.webjars.npm:auth0-js
CVE-2020-7674 Vulnerability in npm package access-policy
CVE-2021-3777 Vulnerability in npm package tmpl
CVE-2021-29459 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web