Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
CVE-2022-32114 — An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file. | Kitploit
Tools/GitHubGitHub/bypazs/cve-2022-32114
Vulnerability AnalysisExploitationWeb Application ExploitationWeb SecurityPenetration Testing
GitHubbypazs/cve-2022-32114

CVE-2022-32114

An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file.

View Repository
114 years agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

Strapi v4.1.12

Vulnerability Explanation:

An unrestricted file upload vulnerability in the Add New Assets function of Strapi v4.1.12 allows attackers to execute arbitrary code via a crafted file

Attack Vectors:

  • After uploading a file containing malicious content, when the user opens the link to the file, it will execute.

Payload :

https://github.com/bypazs/GrimTheRipper/blob/main/GrimTheRipperTeam.pdf

Tested on:

  1. Strapi Version 4.1.12
  2. Google Chrome Version 102.0.5005.61 (Official Build) (64-bit)

Affected Component:

  • On the Media Library page, it is allowed to upload files containing malicious content to the system.

Steps to attack:

  1. Log in with a user that has permission to upload files.
  2. Click on the "Media Library" menu, then click on "+ Add new assets".
  • Click on the "Browse files: button, and then select the prepared file containing malicious content.
  • Then click on the "Upload 1 asset to the library" button to upload the file to the system.
  • Click edit in the corner of the file and click copy link.
  • Paste the link to a new tab, it will show that the payload XSS was executed.

    • Discoverer:

    :shipit: Grim The Ripper Team by SOSECURE Thailand

    Medium:

    • https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4e

    Disclosure Timeline:

    • 2022–05–29: Vulnerability discovered.
    • 2022–05–29: Vulnerability reported to the MITRE corporation.
    • 2022–07–14: CVE has been reserved.
    • 2022–05–29: Public disclosure of the vulnerability.

    Reference:

    1. https://github.com/strapi/strapi
    2. https://strapi.io/
    3. https://github.com/bypazs/strapi
    4. https://grimthereaperteam.medium.com/strapi-v4-1-12-unrestricted-file-upload-b993bfd07e4e
    Download Tool