strapi review

rapid7 · Nov 16, 2024 · dfebca4 · dfebca4
1 parent 2199812
commit dfebca4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/modules/auxiliary/scanner/http/strapi_3_password_reset.rb b/modules/auxiliary/scanner/http/strapi_3_password_reset.rb
@@ -65,7 +65,7 @@ def check
     # npm ERR! gyp: Undefined variable standalone_static_library in binding.gyp while trying to load binding.gyp
     # however vulners shows 3.0.0 and up to 3.0.0-beta.17.4 are vulnerable
     version = Rex::Version.new(version.dig('data', 'strapiVersion'))
-    if version <= Rex::Version.new('3.0.0-beta.17.4') && version >= Rex::Version.new('3.0.0')
+    if version.start_with?('3.0.0-beta') && (Rex::Version.new(version.split('-beta.')[1]) <= Rex::Version.new('17.4'))
       return Exploit::CheckCode::Vulnerable("Vulnerable version detected: #{version.dig('data', 'strapiVersion')}")
     end