CVE-2024-39896
published 2024-07-08CVE-2024-39896: Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.51%
39.3th percentile
Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider. This vulnerability is fixed in 10.13.0.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| directus | directus | — | — |
| directus | directus | >= 9.11 < 10.13.0 | 10.13.0 |
| monospace | directus | < 10.13.0 | 10.13.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Directus Allows Single Sign-On User Enumeration
osv·2024-07-08
CVE-2024-39896 [HIGH] Directus Allows Single Sign-On User Enumeration
Directus Allows Single Sign-On User Enumeration
### Impact
When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider.
### Reproduction
1. Create a user using a SSO provider `[email protected]`.
2. Try to log-in using the regular login form (or the API)
3. When using a valid email address
| **APP** | **API** |
| --- | --- |
| | |
4. When using an invalid email address
| **APP** | **API** |
| --- | --- |
| | |
5. Using this differing error it is possible to determine whether a specific email address is present in the Directus inst
GHSA
Directus Allows Single Sign-On User Enumeration
ghsa·2024-07-08
CVE-2024-39896 [HIGH] CWE-200 Directus Allows Single Sign-On User Enumeration
Directus Allows Single Sign-On User Enumeration
### Impact
When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful" error that the user belongs to another provider.
### Reproduction
1. Create a user using a SSO provider `[email protected]`.
2. Try to log-in using the regular login form (or the API)
3. When using a valid email address
| **APP** | **API** |
| --- | --- |
| | |
4. When using an invalid email address
| **APP** | **API** |
| --- | --- |
| | |
5. Using this differing error it is possible to determine whether a specific email address is present in the Directus inst
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/directus/directus/commit/454cb534d6ffa547feb11f4d74b932ae7368dae2https://github.com/directus/directus/security/advisories/GHSA-jgf4-vwc3-r46vhttps://github.com/directus/directus/commit/454cb534d6ffa547feb11f4d74b932ae7368dae2https://github.com/directus/directus/security/advisories/GHSA-jgf4-vwc3-r46v
2024-07-08
Published