Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
56 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Impact Instances relying on an allow-listed reset URL are vulnerable to an HTML injection attack through the use of query parameters in the reset URL. Patches The problem has been resolved and released under version 9.23.0. People relying on a custom password reset URL should upgrade to 9.23.0 or later, or remove the custom reset url from the configured allow list. Workarounds Disable the custom reset URL allow list.
Recommended action: Upgrade to 9.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directus versions <=9.22.4 is vulnerable to Server-Side Request Forgery (SSRF) when importing a file from a remote web server (POST to /files/import). An attacker can bypass the security controls that were implemented to patch vulnerability CVE-2022-23080 by performing a DNS rebinding attack and view sensitive data from internal servers or perform a local port scan (eg. can access internal metadata API for AWS at http://169.254.169.254 event if 169.254.169.254 is in the deny IP list). Details DNS rebinding attacks work by running a DNS name server that resolves two different IP addresses when a domain is resolved simultaneously. This type of attack can be exploited to bypass the IP address deny list validation that was added to /api/src/services/file.ts for the function importOne to mitigate the previous SSRF vulnerability CVE-2022-23080. The validation in /api/src/services/file.ts first checks if the resolved IP address for a domain name does not a resolve to an IP address…
Recommended action: Upgrade to 9.23.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The Directus process can be aborted by having an authorized user update the filenamedisk value to a folder and accessing that file through the /assets endpoint. The vulnerability is patched and released in v9.15.0. You can prevent this problem by making sure no (untrusted) non-admin users have permissions to update the filenamedisk field on directusfiles. For more information If you have any questions or comments about this advisory: Open a Discussion in directus/directus Email us at security@directus.io Credits This vulnerability was first discovered and reported by Witold Gorecki.
Recommended action: Upgrade to 9.15.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directus versions v9.0.0-beta.2 through 9.6.0 are vulnerable to server-side request forgery (SSRF) in the media upload functionality, which allows a low privileged user to perform internal network port scans.
Recommended action: Upgrade to 9.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The default value for the CORSENABLED and CORSORIGIN configuration was set to be very permissive by default. This could lead to unauthorized access in uncontrolled environments when the configuration hasn't been changed. Patches The default values for CORS have been changed in https://github.com/directus/directus/pull/12022 which is released under 9.7.0 Workarounds Configure the CORS environment variables to match your project's usage, rather than leaving them at the (permissive) defaults. For more information If you have any questions or comments about this advisory: Open an issue in directus/directus Email us at security@directus.io
Recommended action: Upgrade to 9.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact Unauthorized JavaScript can be executed by inserting an iframe into the rich text html interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag. This satisfies the regular content security policy header, which in turn allows the file to run any arbitrary JS. Patches This was resolved in https://github.com/directus/directus/pull/12020 which is released in 9.7.0 Workarounds You can disable the live embed in the WYSIWYG by adding { "medialiveembeds": false } to the Options Overrides option of the Rich Text HTML interface. References https://github.com/directus/directus/pull/12020 For more information If you have any questions or comments about this advisory: Open an issue in directus/directus Email us at security@directus.io
Recommended action: Upgrade to 9.7.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.