{"id":"CVE-2023-39345","aliases":["GHSA-gc7p-j5xm-xxh2"],"url":"https://o3.security/vulnerability/CVE-2023-39345","summary":"Unauthorized Access to Private Fields in User Registration API in strapi","details":"### System Details\n| Name     | Value                  |\n|----------|------------------------|\n| OS       | Windows 11             |\n| Version  | 4.11.1 (node v16.14.2) |\n| Database | mysql                  |\n\n\n### Description\nI marked some fields as private fields in user content-type, and tried to register as a new user via api, at the same time I added content to fill the private fields and sent a post request, and as you can see from the images below, I can write to the private fields.\n\n![register](https://user-images.githubusercontent.com/32245914/246987508-9337ffd5-c681-4f51-9a0b-2490b424ca1e.png)\n\n![user](https://user-images.githubusercontent.com/32245914/246987564-9f440b3f-a7a3-4710-9b75-0854667fc35d.png)\n\n![private_field](https://user-images.githubusercontent.com/32245914/246987590-9c0ecefd-fd64-4221-b642-e730ea55d440.png)\n\n![table](https://user-images.githubusercontent.com/32245914/246987604-009e6808-5690-458e-aa87-57dda7d4589d.png)\n\nTo prevent this, I went to the extension area and tried to extend the register method, for this I wanted to do it using the sanitizeInput function that I know in the source codes of the strap. But the sanitizeInput function did not filter out private fields.\n\n```js\n  const { auth } = ctx.state;\n  const data = ctx.request.body;\n  const userSchema = strapi.getModel(\"plugin::users-permissions.user\");\n\n  sanitize.contentAPI.input(data, userSchema, { auth });\n```\n\nhere's the solution I've temporarily kept to myself, code snippet\n\n```js\n  const body = ctx.request.body;\n\n  const { attributes } = strapi.getModel(\"plugin::users-permissions.user\");\n\n  const sanitizedData = _.omitBy(body, (data, key) => {\n    const attribute = attributes[key];\n\n    if (_.isNil(attribute)) {\n      return false;\n    }\n\n    //? If you want, you can throw an error for fields that we did not expect.\n\n    // if (_.isNil(attribute))\n    //   throw new ApplicationError(`Unexpected value ${key}`);\n\n    // if private value is true, we do not want to send it to the database.\n    return attribute.private;\n  });\n\n  return sanitizedData;\n```\n\n","published":"2023-11-06T18:26:20.324Z","modified":"2026-08-12T03:51:08.962415144Z","cvss":{"score":7.6,"severity":"HIGH","vector":"CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"npm","name":"@strapi/plugin-users-permissions","fixedVersion":"4.13.1"},{"ecosystem":"npm","name":"@strapi/strapi","fixedVersion":"4.13.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39345.json"},{"type":"ADVISORY","url":"https://github.com/strapi/strapi/security/advisories/GHSA-gc7p-j5xm-xxh2"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-39345"},{"type":"PACKAGE","url":"https://github.com/strapi/strapi"},{"type":"WEB","url":"https://strapi.io/blog/security-disclosure-of-vulnerabilities-sept-2023"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:08.962415144Z"}}