Rijk van Zanten

11 exploits Active since Jan 2022
CVE-2024-46990 WRITEUP MEDIUM WRITEUP
Directus < 10.13.3 - Improper Access Control via Loopback Device Bypass
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.
CVSS 5.0
CVE-2024-46990 WRITEUP MEDIUM WRITEUP
Directus < 10.13.3 - Improper Access Control via Loopback Device Bypass
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.
CVSS 5.0
CVE-2024-45596 WRITEUP HIGH WRITEUP
Directus < 10.13.3 - Unauthenticated Credential Exposure via OpenID/OAuth2 Redirect Cache
Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0.
CVSS 7.4
CVE-2024-46990 WRITEUP MEDIUM WRITEUP
Directus < 10.13.3 - Improper Access Control via Loopback Device Bypass
Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users are advised to upgrade. Users unable to upgrade may block this bypass by manually adding the `127.0.0.0/8` CIDR range which will block access to any `127.X.X.X` ip instead of just `127.0.0.1`.
CVSS 5.0
CVE-2022-22116 WRITEUP MEDIUM WRITEUP
Directus 9.0.0-alpha.4-9.4.1 - Stored Cross-Site Scripting via SVG File Upload
In Directus, versions 9.0.0-alpha.4 through 9.4.1 are vulnerable to stored Cross-Site Scripting (XSS) vulnerability via SVG file upload in media upload functionality. A low privileged attacker can inject arbitrary javascript code which will be executed in a victim’s browser when they open the image URL.
CVSS 5.4
CVE-2022-22117 WRITEUP MEDIUM WRITEUP
Directus 9.0.0-alpha.4-9.4.1 - Stored Cross-Site Scripting via HTML File Upload
In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.
CVSS 5.4
CVE-2022-23080 WRITEUP MEDIUM WRITEUP
Directus 9.0.0-beta.2-9.6.0 - Server-Side Request Forgery via Media Upload Functionality
In directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality which allows a low privileged user to perform internal network port scans.
CVSS 5.0
CVE-2023-45820 WRITEUP MEDIUM WRITEUP
Directus 10.4.0-10.6.1 - Denial of Service via Invalid WebSocket Frame
Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to upgrade. Users unable to upgrade should avoid using websockets.
CVSS 5.9
CVE-2024-39896 WRITEUP HIGH WRITEUP
Directus < 10.13.0 - User Enumeration via SSO Error Messages
Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.
CVSS 7.5
CVE-2024-45596 WRITEUP HIGH WRITEUP
Directus < 10.13.3 - Unauthenticated Credential Exposure via OpenID/OAuth2 Redirect Cache
Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, which by default will try to cache GET requests that met some conditions. Although, those conditions do not include this scenario, when an unauthenticated request returns user credentials. This vulnerability is fixed in 10.13.3 and 11.1.0.
CVSS 7.4
CVE-2024-47822 WRITEUP MEDIUM WRITEUP
Directus < 10.13.2 - Sensitive Information Exposure in Log Files via Query String Access Token
Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker with access to it can potentially gain administrative control, leading to unauthorized data access and manipulation. This impacts systems where the `LOG_STYLE` is set to `raw`. The `access_token` in the query could potentially be a long-lived static token. Users with impacted systems should rotate their static tokens if they were provided using query string. This vulnerability has been patched in release version 10.13.2 and subsequent releases as well. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS 4.2