Search for packages
| purl | pkg:npm/directus@9.17.2 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-3cgw-zr3k-3fen
Aliases: CVE-2024-28238 GHSA-2ccr-g2rv-h677 |
Session Token in URL in directus ### Impact When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user. ### Patches _Has the problem been patched? What versions should users upgrade to?_ ### Workarounds There's no workaround available. ### References _Are there any links users can visit to find out more?_ |
Affected by 3 other vulnerabilities. |
|
VCID-8r4e-a1vf-9bd9
Aliases: CVE-2024-28239 GHSA-fr3w-2p22-6w7p |
URL Redirection to Untrusted Site in OAuth2/OpenID in directus ### Summary The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL https://docs.directus.io/reference/authentication.html#login-using-sso-providers /auth/login/google?redirect for example. ### Details There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redirect=http://malicious-fishing-site.com`, which I think is here: https://github.com/directus/directus/blob/main/api/src/auth/drivers/oauth2.ts#L394. While credentials don't seem to be passed to the attacker site, the user can be phished into clicking a legitimate directus site and be taken to a malicious site made to look like a an error message "Your password needs to be updated" to phish out the current password. ### PoC Turn on any auth provider in Directus instance. Form a link to `directus-instance/auth/login/:provider_id?redirect=http://malicious-fishing-site.com`, login and get taken to malicious-site. Tested on the `ory` OAuth2 integration. ### Impact Users who login via OAuth2 into Directus. |
Affected by 3 other vulnerabilities. |
|
VCID-ejme-tqn4-byhk
Aliases: CVE-2024-27296 GHSA-5mhg-wv8w-p59j |
Directus version number disclosure ### Impact Currently the exact Directus version number is being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shipped dependencies in that specific running version. ### Patches The problem has been resolved in versions 10.8.3 and newer ### Workarounds None |
Affected by 2 other vulnerabilities. |
|
VCID-eygf-cb4y-hqd3
Aliases: CVE-2023-28443 GHSA-8vg2-wf3q-mwv7 |
Insertion of Sensitive Information into Log File Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3. |
Affected by 5 other vulnerabilities. |
|
VCID-gjju-tu4e-gqfc
Aliases: CVE-2024-27295 GHSA-qw9g-7549-7wg5 |
Directus has MySQL accent insensitive email matching ## Password reset vulnerable to accent confusion The password reset mechanism of the Directus backend is implemented in a way where combined with (specific, need to double check if i can work around) configuration in MySQL or MariaDB. As such, it allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact that by default MySQL/MariaDB are configured for accent-insenstive and case-insensitve comparisons. MySQL weak comparison: ```sql select 1 from directus_users where 'julian@cure53.de' = 'julian@cüre53.de'; ``` This is exploitable due to an error in the API using the supplied email address for sending the reset password mail instead of using the email from the database. ### Steps to reproduce: 1. If the attacker knows the email address of the victim user, i.e., `julian@cure53.de`. (possibly just the domain could be enough for an educated guess) 2. A off-by-one accented domain `cüre53.de` can be registered to be able to receive emails. 3. With this email the attacker can request a password reset for `julian@cüre53.de`. ```http POST /auth/password/request HTTP/1.1 Host: example.com [...] {"email":"julian@cüre53.de"} ``` 4. The supplied email (julian@cüre53.de) gets checked against the database and will match the non-accented email `julian@cure53.de` and will continue to email the password reset link to the provided email address instead of the saved email address. 5. With this email the attacker can log into the target account and use it for nefarious things ### Workarounds Should be possible with collations but haven't been able to confirm this. ### References - https://www.monolune.com/articles/what-is-the-utf8mb4_0900_ai_ci-collation/ - https://dev.mysql.com/doc/refman/8.0/en/charset-unicode-sets.html |
Affected by 2 other vulnerabilities. |
|
VCID-hrqc-8err-4fbx
Aliases: GHSA-22rr-f3p8-5gf8 GMS-2023-2358 |
Directus affected by VM2 sandbox escape vulnerability ### Impact In vm2 for versions up to 3.9.19, Promise handler sanitization can be bypassed, allowing attackers to escape the sandbox and run arbitrary code. Within Directus this applies to the "Run Script" operation in flows being able to escape the sandbox running code in the main nodejs context. ### Patches Patched in v10.6.0 by replacing `vm2` with `isolated-vm` ### Workarounds None ### References https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5 |
Affected by 5 other vulnerabilities. |
|
VCID-szny-2sbf-v7de
Aliases: CVE-2023-26492 GHSA-j3rg-3rgm-537h |
Directus is a real-time API and App dashboard for managing SQL database content. Directus is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to `/files/import`). An attacker can bypass the security controls by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan. An attacker can exploit this vulnerability to access highly sensitive internal server(s) and steal sensitive information. This issue was fixed in version 9.23.0. |
Affected by 1 other vulnerability. Affected by 6 other vulnerabilities. |
|
VCID-v4vz-smcx-gygb
Aliases: CVE-2023-27474 GHSA-4hmq-ggrm-qfc6 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Directus is a real-time API and App dashboard for managing SQL database content. Instances relying on an allow-listed reset URL is vulnerable to an HTML injection attack through the use of query parameters in the reset URL. An attacker could exploit this to email users urls to the servers domain but which may contain malicious code. The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list. Users are advised to upgrade. Users unable to upgrade may disable the custom reset URL allow list as a workaround. |
Affected by 1 other vulnerability. Affected by 6 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||