Unrestricted file upload

2022-01-1016:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

21.5%

JSON

In Directus, versions 9.0.0-alpha.4 through 9.4.1 allow unrestricted file upload of .html files in the media upload functionality, which leads to Cross-Site Scripting vulnerability. A low privileged attacker can upload a crafted HTML file as a profile avatar, and when an admin or another user opens it, the XSS payload gets triggered.

CPENameOperatorVersion
directuseq9.0.0 rc74
directuseq9.0.0 rc75
directuseq9.0.0 rc76
directuseq9.0.0 rc77
directuseq9.0.0 rc78
directuseq9.0.0 rc79
directuseq9.0.0 rc80
directuseq9.0.0 rc81
directuseq9.0.0 rc82
directuseq9.0.0 rc83

Name	Operator	Version
directus	eq	9.0.0 rc74
directus	eq	9.0.0 rc75
directus	eq	9.0.0 rc76
directus	eq	9.0.0 rc77
directus	eq	9.0.0 rc78
directus	eq	9.0.0 rc79
directus	eq	9.0.0 rc80
directus	eq	9.0.0 rc81
directus	eq	9.0.0 rc82
directus	eq	9.0.0 rc83