directus@0.1.0-preview.11

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Incorrect Authorization in the TUS upload process. An attacker can overwrite arbitrary files and corrupt metadata by uploading files with the UUID of existing files, bypassing item-level access controls. This can lead to permanent data loss, unauthorized modification of files, and potential privilege escalation if sensitive files are replaced.

Upgrade directus to version 11.16.1 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cleartext Storage of Sensitive Information in the process that stores revision records and logs flow operation payloads, where sensitive fields are not properly sanitized or redacted. An attacker can gain unauthorized access to confidential information, such as authentication tokens, two-factor authentication secrets, external identifiers, credentials, and API keys, by reading unredacted data from revision records or flow logs.

Upgrade directus to version 11.17.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Incorrect Authorization in the aggregate query process when applying min or max functions to fields marked as concealed. An attacker can retrieve sensitive concealed field values, such as static API tokens and two-factor authentication secrets, by issuing aggregate queries with groupBy as an authenticated user with read access to the affected collection.

Upgrade directus to version 11.17.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in the file import process due to improper normalization of IPv4-mapped IPv6 addresses. An attacker can access internal network resources by supplying specially crafted IP address formats that bypass deny-list validation. This is only exploitable if public file-import permissions are enabled.

Upgrade directus to version 11.16.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes via the filename_disk parameter in the file management API. An attacker can overwrite files belonging to other users, write files outside intended storage boundaries, and potentially execute arbitrary code by manipulating this parameter in file upload or update requests.

Upgrade directus to version 11.17.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the GraphQL resolver process. An attacker can exhaust server resources and cause service degradation or outage by submitting a single request containing numerous aliases that trigger repeated execution of expensive relational queries. This is only exploitable if rate limiting is disabled.

Upgrade directus to version 11.17.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Protection Mechanism Failure in the handling of Single Sign-On login pages due to the absence of the Cross-Origin-Opener-Policy HTTP response header. An attacker can gain unauthorized access to authentication provider accounts by opening the login page in a malicious cross-origin window and intercepting or redirecting the OAuth authorization flow.

Upgrade directus to version 11.17.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the health check resolver process. An attacker can exhaust system resources, leading to service degradation or outage, by sending a single unauthenticated GraphQL request that repeatedly invokes the resolver using multiple aliases.

Upgrade directus to version 11.17.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Information Exposure via the server_specs_graphql resolver on the /graphql/system endpoint, which returns an SDL representation of the schema even when introspection is disabled. An attacker can obtain sensitive schema structure information by sending requests to this endpoint without authentication. This is only exploitable if the GRAPHQL_INTROSPECTION setting is set to false.

Upgrade directus to version 11.16.1 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Open Redirect via the isLoginRedirectAllowed function during the authentication flow. An attacker can redirect users to arbitrary external domains by crafting URLs with malformed path segments that bypass server-side validation but are interpreted as external by browsers. This can lead to users being redirected to attacker-controlled sites after authentication, potentially resulting in phishing or credential theft.

Upgrade directus to version 11.16.1 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Improper Privilege Management via the Share feature. An attacker can escalate privileges and access data or functionalities that are normally restricted by specifying an arbitrary role during the item sharing process. This is only exploitable if the instance uses the share feature and has specific roles hierarchy and fields that are not visible for certain roles.

Upgrade directus to version 11.2.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) through the layout_options due to improper user input sanitization in the setContent function. An attacker can execute arbitrary scripts in the context of the user's session by injecting malicious JavaScript into unsanitized DOM elements that are subsequently rendered by the client. This is only exploitable if the attacker has permissions to modify or create presets for other users or can chain with another vulnerability to escalate privileges.

Upgrade directus to version 11.3.3 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the PATCH /presets endpoint when the application only validates the user parameter in the POST /presets request but not in the PATCH request. An attacker can modify presets created by the same user to assign them to another user by sending a crafted PATCH request with the victim's user ID. This is only exploitable if the attacker has valid authentication credentials and can access the preset ID.

Upgrade directus to version 10.13.2 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /presets and PATCH requests. An authenticated attacker can modify presets created by the same user to assign them to another user by exploiting the lack of validation for the user parameter in the PATCH request.

Note:

When chained with CVE-2024-6533, it could result in account takeover.

Upgrade directus to version 10.13.2 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an attacker-controlled parameter that is stored on the server and subsequently used unsanitized in a DOM element. An attacker can execute arbitrary JavaScript on the client by injecting malicious code into this parameter.

Note:

When chained with CVE-2024-6534, it could result in account takeover.

Upgrade directus to version 11.3.3 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF) due to improper check when importing file from the URL and the result URL. An attacker can execute unauthorized requests to internal network resources by manipulating URL redirects during the file import operation.

Upgrade directus to version 10.9.3 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Resource Exhaustion through the /graphql endpoint. An attacker can cause the server to perform redundant computations and consume excessive resources.

Upgrade directus to version 10.12.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Improper Check for Unusual or Exceptional Conditions through the random string generation utility. An attacker can disrupt the service by providing a non-numeric length value, which leads to a memory issue that prevents the generation of random strings, affecting session refresh capabilities.

Upgrade directus to version 10.11.2 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Information Exposure through the alias functionality. An attacker can access sensitive data by manipulating the API request parameters.

Notes:

This is only exploitable if the user has permissions to view any collection using redacted hashed fields.

Steps to reproduce:

1. Set up a simple role with read-access to users.

2. Create a new user with the role from the previous step

3. Assign a password to the user

To confirm this vulnerability, visit /users/me. You should be presented with a redacted JSON-object. Next, visit /users/me?alias[hash]=password. This time, the returned JSON object will included the raw password hash instead of the redacted value.

Upgrade directus to version 10.11.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') via the redirect parameter in the authentication API. An attacker can redirect users to an untrusted site after successful login, potentially leading to phishing attacks by presenting a malicious site that mimics an error message to deceive users into providing sensitive information.

Upgrade directus to version 10.10.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the process of reaching the /files page where a JWT is passed through a GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places such as web server logs and browser history. Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user.

Upgrade directus to version 10.10.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the password reset mechanism implementation combined with default database configurations in MySQL and MariaDB. This allows attackers in possession of a known good email address to redirect a password reset email intended for a victim by registering a similar email address with alternative characters that are considered equivalent to the same ones as characters in the stored email address, by the database engine. The API uses the supplied email address for sending the reset password mail instead of the email address from the database.

Upgrade directus to version 10.8.3 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata in the form of the version number, which is included in compiled JS bundles that are accessible without authentication.

Upgrade directus to version 10.8.3 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Information Exposure when users with read access to the password field in directus_users can extract the argon2 password hashes by brute-forcing the export functionality combined with a _starts_with filter. This allows the user to enumerate the password hashes.

Upgrade directus to version 9.16.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) by allowing attackers to email users URLs to the servers domain but which may contain malicious code.

Upgrade directus to version 9.23.1 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Server-Side Request Forgery when importing a file from a remote web server (POST to /files/import). This is a bypass of CVE-2022-23080.

Upgrade directus to version 9.23.1 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Access Restriction Bypass by having an authorized user update the filename_disk value to a folder and accessing that file through the /assets endpoint.

Upgrade directus to version 9.15.0 or higher.

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Insecure Defaults via the default value for the CORS_ENABLED and CORS_ORIGIN configuration, which was set to be very permissive.

Upgrade directus to version 9.7.0 or higher.