Information Exposure Affecting directus package, versions <9.16.0
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-JS-DIRECTUS-3356644
- published 8 Mar 2023
- disclosed 8 Mar 2023
- credit wgorecki, Erik van Oosbree
Introduced: 8 Mar 2023
CVE-2023-27481 Open this link in a new tabHow to fix?
Upgrade directus to version 9.16.0 or higher.
Overview
directus is a Directus is a real-time API and App dashboard for managing SQL database content.
Affected versions of this package are vulnerable to Information Exposure when users with read access to the password field in directus_users can extract the argon2 password hashes by brute-forcing the export functionality combined with a _starts_with filter. This allows the user to enumerate the password hashes.
Workaround
Users unable to upgrade may mitigate this issue by ensuring that no user has read access to the password field in directus_users.