CVE-2025-25298

描述

## Summary Strapi's password hashing implementation using bcryptjs lacks maximum password length validation. Since bcryptjs truncates passwords exceeding 72 bytes, this creates potential vulnerabilities such as authentication bypass and performance degradation. ## POC Create an admin user with a password exceeding 72 characters like 85, Log in using only the first 72 characters of the password. Authentication is successful, confirming the issue. Proposed Solution Based on discussions: Add a maximum password length validation (72 characters) during password creation and updates for both Admin and U&P users. Truncate passwords exceeding 72 bytes on the server before passing them to bcryptjs during login. Optionally, issue a warning to users with passwords longer than 72 bytes during login, informing them of truncation. ## Impact This issue affects all Strapi installations using bcryptjs for password hashing. Until resolved, it can lead to: Authentication Bypass: Users may unknowingly set passwords exceeding 72 bytes, leading to truncated, predictable hashes. Performance Issues: Excessively long passwords can degrade server performance.

如何修補 CVE-2025-25298

要修補 CVE-2025-25298,請將受影響套件升級到下列已修補版本。

• —升級至 5.10.3 或更新版本

CVE-2025-25298 正在被利用嗎?

低 — EPSS 為 0.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 5.10.3

CVSS 分數

參考連結(4)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2025-25298
• PATCHgithub.com/strapi/strapi
• WEBgithub.com/strapi/strapi/commit/41f8cdf116f7f464dae7d591e52d88f7bfa4b7cb
• WEBgithub.com/strapi/strapi/security/advisories/GHSA-2cjv-6wg9-f4f3