directus@9.0.0-rc.94 vulnerabilities

Directus is a real-time API and App dashboard for managing SQL database content

Direct Vulnerabilities

Known vulnerabilities in the directus package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
URL Redirection to Untrusted Site ('Open Redirect')

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to URL Redirection to Untrusted Site ('Open Redirect') via the redirect parameter in the authentication API. An attacker can redirect users to an untrusted site after successful login, potentially leading to phishing attacks by presenting a malicious site that mimics an error message to deceive users into providing sensitive information.

How to fix URL Redirection to Untrusted Site ('Open Redirect')?

Upgrade directus to version 10.10.0 or higher.

<10.10.0
  • L
Information Exposure Through Sent Data

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Information Exposure Through Sent Data via the process of reaching the /files page where a JWT is passed through a GET request. Inclusion of session tokens in URLs poses a security risk as URLs are often logged in various places such as web server logs and browser history. Attackers gaining access to these logs may hijack active user sessions, leading to unauthorized access to sensitive information or actions on behalf of the user.

How to fix Information Exposure Through Sent Data?

Upgrade directus to version 10.10.0 or higher.

<10.10.0
  • M
Always-Incorrect Control Flow Implementation

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Always-Incorrect Control Flow Implementation due to the password reset mechanism implementation combined with default database configurations in MySQL and MariaDB. This allows attackers in possession of a known good email address to redirect a password reset email intended for a victim by registering a similar email address with alternative characters that are considered equivalent to the same ones as characters in the stored email address, by the database engine. The API uses the supplied email address for sending the reset password mail instead of the email address from the database.

How to fix Always-Incorrect Control Flow Implementation?

Upgrade directus to version 10.8.3 or higher.

<10.8.3
  • M
Exposure of Sensitive Information Through Metadata

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Exposure of Sensitive Information Through Metadata in the form of the version number, which is included in compiled JS bundles that are accessible without authentication.

How to fix Exposure of Sensitive Information Through Metadata?

Upgrade directus to version 10.8.3 or higher.

<10.8.3
  • M
Information Exposure

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Information Exposure when users with read access to the password field in directus_users can extract the argon2 password hashes by brute-forcing the export functionality combined with a _starts_with filter. This allows the user to enumerate the password hashes.

How to fix Information Exposure?

Upgrade directus to version 9.16.0 or higher.

<9.16.0
  • H
Cross-site Scripting (XSS)

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) by allowing attackers to email users URLs to the servers domain but which may contain malicious code.

How to fix Cross-site Scripting (XSS)?

Upgrade directus to version 9.23.1 or higher.

<9.23.1
  • M
Server-Side Request Forgery

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Server-Side Request Forgery when importing a file from a remote web server (POST to /files/import). This is a bypass of CVE-2022-23080.

How to fix Server-Side Request Forgery?

Upgrade directus to version 9.23.1 or higher.

<9.23.1
  • M
Access Restriction Bypass

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Access Restriction Bypass by having an authorized user update the filename_disk value to a folder and accessing that file through the /assets endpoint.

How to fix Access Restriction Bypass?

Upgrade directus to version 9.15.0 or higher.

<9.15.0
  • M
Server-side Request Forgery (SSRF)

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) by exposing port information to low-privileged users via the media upload functionality.

How to fix Server-side Request Forgery (SSRF)?

Upgrade directus to version 9.7.0 or higher.

>=9.0.0-beta.2 <9.7.0
  • H
Insecure Defaults

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Insecure Defaults via the default value for the CORS_ENABLED and CORS_ORIGIN configuration, which was set to be very permissive.

How to fix Insecure Defaults?

Upgrade directus to version 9.7.0 or higher.

<9.7.0
  • M
Cross-site Scripting (XSS)

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) by inserting an iframe into the rich text HTML interface that links to a file uploaded HTML file that loads another uploaded JS file in its script tag.

How to fix Cross-site Scripting (XSS)?

Upgrade directus to version 9.7.0 or higher.

<9.7.0
  • M
Cross-site Scripting (XSS)

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via unrestricted file upload of HTML files, of which content isn't escaped, in the media upload feature. This HTML file can be set as an avatar, and when another user opens it the payload is executed.

How to fix Cross-site Scripting (XSS)?

Upgrade directus to version 9.4.2 or higher.

>=9.0.0-alpha.5 <9.4.2
  • M
Cross-site Scripting (XSS)

directus is a Directus is a real-time API and App dashboard for managing SQL database content.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via an SVG file upload in the media upload functionality. An attacker can include javascript code inside the image which will be executed in the victim’s browser when they open the image URL.

How to fix Cross-site Scripting (XSS)?

Upgrade directus to version 9.4.2 or higher.

>=9.0.0-alpha.5 <9.4.2