Monospace Directus vulnerabilities

CVE-2024-47822 [MEDIUM] CWE-532 CVE-2024-47822: Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are potentially exposed in system logs which may be persisted. The access token in `req.query` is not redacted when the `LOG_STYLE` is set to `raw`. If these logs are not properly sanitized or protected, an attacker w

CVE-2024-46990 [MEDIUM] CWE-284 CVE-2024-46990: Directus is a real-time API and App dashboard for managing SQL database content. When relying on blo Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default `0.0.0.0` filter a user may bypass this block by using other registered loopback devices (like `127.0.0.2` - `127.127.127.127`). This issue has been addressed in release versions 10.13.3 and 11.1.0. Users ar

CVE-2024-45596 [MEDIUM] CWE-524 CVE-2024-45596: Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId and Oauth2 Directus is using the respond middleware, w

CVE-2024-6534 [MEDIUM] CVE-2024-6534: Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same us Directus v10.13.0 allows an authenticated external attacker to modify presets created by the same user to assign them to another user. This is possible because the application only validates the user parameter in the 'POST /presets' request but not in the PATCH request. When chained with CVE-2024-6533, it could result in account takeover.

CVE-2024-6533 [MEDIUM] CWE-79 CVE-2024-6533: Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the c Directus v10.13.0 allows an authenticated external attacker to execute arbitrary JavaScript on the client. This is possible because the application injects an attacker-controlled parameter that will be stored in the server and used by the client into an unsanitized DOM element. When chained with CVE-2024-6534, it could result in account takeover.

CVE-2024-39701 [HIGH] CWE-284 CVE-2024-39701: Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, Directus is a real-time API and App dashboard for managing SQL database content. Directus >=9.23.0, <=v10.5.3 improperly handles _in, _nin operators. It evaluates empty arrays as valid so expressions like {"role": {"_in": $CURRENT_USER.some_field}} would evaluate to true allowing the request to pass. This results in Broken Access Control because the ru

CVE-2024-39699 [MEDIUM] CWE-918 CVE-2024-39699: Directus is a real-time API and App dashboard for managing SQL database content. There was already a Directus is a real-time API and App dashboard for managing SQL database content. There was already a reported SSRF vulnerability via file import. It was fixed by resolving all DNS names and checking if the requested IP is an internal IP address. However it is possible to bypass this security measure and execute a SSRF using redirects. Directus allow

CVE-2024-39895 [MEDIUM] CWE-400 CVE-2024-39895: Directus is a real-time API and App dashboard for managing SQL database content. A denial of service Directus is a real-time API and App dashboard for managing SQL database content. A denial of service (DoS) attack by field duplication in GraphQL is a type of attack where an attacker exploits the flexibility of GraphQL to overwhelm a server by requesting the same field multiple times in a single query. This can cause the server to perform redundant

CVE-2024-39896 [MEDIUM] CWE-200 CVE-2024-39896: Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO Directus is a real-time API and App dashboard for managing SQL database content. When relying on SSO providers in combination with local authentication it can be possible to enumerate existing SSO users in the instance. This is possible because if an email address exists in Directus and belongs to a known SSO provider then it will throw a "helpful"

CVE-2024-36128 [HIGH] CWE-754 CVE-2024-36128: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, p Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.2, providing a non-numeric length value to the random string generation utility will create a memory issue breaking the capability to generate random strings platform wide. This creates a denial of service situation where logged in sessions can no longer be

CVE-2024-34708 [MEDIUM] CWE-200 CVE-2024-34708: Directus is a real-time API and App dashboard for managing SQL database content. A user with permiss Directus is a real-time API and App dashboard for managing SQL database content. A user with permission to view any collection using redacted hashed fields can get access the raw stored version using the `alias` functionality on the API. Normally, these redacted fields will return `**********` however if we change the request to `?alias[workaround]=

CVE-2024-34709 [MEDIUM] CWE-613 CVE-2024-34709: Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, s Directus is a real-time API and App dashboard for managing SQL database content. Prior to 10.11.0, session tokens function like the other JWT tokens where they are not actually invalidated when logging out. The `directus_session` gets destroyed and the cookie gets deleted but if the cookie value is captured, it will still work for the entire expiry

CVE-2024-28239 [MEDIUM] CWE-601 CVE-2024-28239: Directus is a real-time API and App dashboard for managing SQL database content. The authentication Directus is a real-time API and App dashboard for managing SQL database content. The authentication API has a `redirect` parameter that can be exploited as an open redirect vulnerability as the user tries to log in via the API URL. There's a redirect that is done after successful login via the Auth API GET request to `directus/auth/login/google?redir

CVE-2024-28238 [LOW] CWE-200 CVE-2024-28238: Directus is a real-time API and App dashboard for managing SQL database content. When reaching the / Directus is a real-time API and App dashboard for managing SQL database content. When reaching the /files page, a JWT is passed via GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places (e.g., web server logs, browser history). Attackers gaining access to these logs may hijack active user sess

CVE-2024-27295 [HIGH] CWE-706 CVE-2024-27295: Directus is a real-time API and App dashboard for managing SQL database content. The password reset Directus is a real-time API and App dashboard for managing SQL database content. The password reset mechanism of the Directus backend allows attackers to receive a password reset email of a victim user, specifically having it arrive at a similar email address as the victim with a one or more characters changed to use accents. This is due to the fact th

CVE-2024-27296 [MEDIUM] CWE-200 CVE-2024-27296: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10 Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 10.8.3, the exact Directus version number was being shipped in compiled JS bundles which are accessible without authentication. With this information a malicious attacker can trivially look for known vulnerabilities in Directus core or any of its shippe

CVE-2023-45820 [MEDIUM] CWE-755 CVE-2023-45820: Directus is a real-time API and App dashboard for managing SQL database content. In affected version Directus is a real-time API and App dashboard for managing SQL database content. In affected versions any Directus installation that has websockets enabled can be crashed if the websocket server receives an invalid frame. A malicious user could leverage this bug to crash Directus. This issue has been addressed in version 10.6.2. Users are advised to

CVE-2023-38503 [MEDIUM] CWE-200 CVE-2023-38503: Directus is a real-time API and App dashboard for managing SQL database content. Starting in version Directus is a real-time API and App dashboard for managing SQL database content. Starting in version 10.3.0 and prior to version 10.5.0, the permission filters (i.e. `user_created IS $CURRENT_USER`) are not properly checked when using GraphQL subscription resulting in unauthorized users getting event on their subscription which they should not be re

CVE-2020-19850 [MEDIUM] CWE-400 CVE-2020-19850: An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a g An issue found in Directus API v.2.2.0 allows a remote attacker to cause a denial of service via a great amount of HTTP requests.

CVE-2023-28443 [MEDIUM] CWE-284 CVE-2023-28443: Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9. Directus is a real-time API and App dashboard for managing SQL database content. Prior to version 9.23.3, the `directus_refresh_token` is not redacted properly from the log outputs and can be used to impersonate users without their permission. This issue is patched in version 9.23.3.