Local Host Access Bypass

Directus is vulnerable to a Local Host Access Bypass. The vulnerability is due to improper filtering of loopback addresses, where only 127.0.0.1 is blocked, but other 127.X.X.X addresses can bypass restrictions, allowing an attacker to gain unauthorized access to local services...

directus (>=11.0.0, <=11.0.1) potentially affected by CVE-2024-46990 via @directus/api (>=22.0.0, <=22.1.0)

@directus/api NPM version =22.0.0, =11.0.0, =11.0.1 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

@directus/api (>=20.0.0-rc.0, <=22.1.1) potentially affected by CVE-2024-46990 via directus (>=11.0.0, <=11.0.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =22.1.1 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

Directus vulnerable to SSRF Loopback IP filter bypass

Impact If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices like 127.0.0.2 - 127.127.127.127 Workaround You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any...

@directus/api (>=15.0.0, <=21.0.1), directus-extension-baetorra-booking (>=1.2.0, <=2.0.0) potentially affected by CVE-2024-46990 via directus (>=10.8.3, <=10.13.2)

directus NPM version =10.8.3, =15.0.0, =1.2.0, =2.0.0 Source cves: CVE-2024-46990 Source advisory: OSV:GHSA-68G8-C275-XF2M...

GHSA-68G8-C275-XF2M Directus vulnerable to SSRF Loopback IP filter bypass

Impact If you're relying on blocking access to localhost using the default 0.0.0.0 filter this can be bypassed using other registered loopback devices like 127.0.0.2 - 127.127.127.127 Workaround You can block this bypass by manually adding the 127.0.0.0/8 CIDR range which will block access to any...

CVE-2024-46990

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default 0.0.0.0 filter a user may bypass this block by using other registered loopback devices like 127.0.0.2 - 127.127.127.127. This issue has been addressed in...

CVE-2024-46990 SSRF Loopback IP filter bypass in directus

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default 0.0.0.0 filter a user may bypass this block by using other registered loopback devices like 127.0.0.2 - 127.127.127.127. This issue has been addressed in...

CVE-2024-46990 SSRF Loopback IP filter bypass in directus

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default 0.0.0.0 filter a user may bypass this block by using other registered loopback devices like 127.0.0.2 - 127.127.127.127. This issue has been addressed in...

CVE-2024-46990

Summary: CVE-2024-46990 affects Directus where blocking localhost via the default 0.0.0.0 filter can be bypassed using other loopback addresses (e.g., 127.0.0.2–127.127.127.127). Vulnerability details (supported by connected docs): Directus real-time API and app dashboard fails to restrict access...

CVE-2024-46990 SSRF Loopback IP filter bypass in directus

Directus is a real-time API and App dashboard for managing SQL database content. When relying on blocking access to localhost using the default 0.0.0.0 filter a user may bypass this block by using other registered loopback devices like 127.0.0.2 - 127.127.127.127. This issue has been addressed in...

Directus 访问控制错误漏洞

Directus is a real-time Api and application dashboard from Directus Open Source. It is used to manage Sql database content. An Access Control Error vulnerability exists in Directus versions prior to 10.13.2, which stems from the fact that when relying on the use of a default filter to block acces...

Session Fixation

Directus is vulnerable to Session Fixation. The vulnerability is due to improper caching of unauthenticated requests via OpenID or OAuth2 endpoints, allowing unauthenticated users to access the credentials of the last authenticated user...

directus (>=11.0.0, <=11.0.2) potentially affected by CVE-2024-45596 via @directus/api (>=22.0.0, <=22.1.1)

@directus/api NPM version =22.0.0, =11.0.0, =11.0.2 Source cves: CVE-2024-45596 Source advisory: OSV:GHSA-CFF8-X7JV-4FM8...

@directus/api (21.0.1), directus (>=10.13.2, <=11.0.0-rc.3) potentially affected by CVE-2024-45596 via @directus/api (21.0.0-rc.0)

@directus/api NPM version 21.0.0-rc.0 is affected by a known vulnerability. The following packages have a transitive dependency on @directus/api and may be impacted: - @directus/api 21.0.1 - directus =10.13.2, =11.0.0-rc.3 Source cves: CVE-2024-45596 Source advisory: OSV:GHSA-CFF8-X7JV-4FM8...

@directus/api (>=20.0.0-rc.0, <=22.1.1) potentially affected by CVE-2024-45596 via directus (>=11.0.0, <=11.0.2)

directus NPM version =11.0.0, =20.0.0-rc.0, =22.1.1 Source cves: CVE-2024-45596 Source advisory: OSV:GHSA-CFF8-X7JV-4FM8...

@directus/api (>=15.0.0, <=21.0.1), directus-extension-baetorra-booking (>=1.2.0, <=2.0.0) potentially affected by CVE-2024-45596 via directus (>=10.8.3, <=10.13.2)

directus NPM version =10.8.3, =15.0.0, =1.2.0, =2.0.0 Source cves: CVE-2024-45596 Source advisory: OSV:GHSA-CFF8-X7JV-4FM8...

GHSA-CFF8-X7JV-4FM8 Session is cached for OpenID and OAuth2 if `redirect` is not used

Summary Unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. For example: - Project is configured with OpenID or OAuth2 - Project is configured with cache enabled - User tries to login via S...

CVE-2024-45596

Directus is a real-time API and App dashboard for managing SQL database content. An unauthenticated user can access credentials of last authenticated user via OpenID or OAuth2 where the authentication URL did not include redirect query string. This happens because on that endpoint for both OpenId...

CVE-2024-45596

Summary: Directus real-time API/dashboard contains a vulnerability where an unauthenticated user can obtain the credentials of the last authenticated user via OpenID or OAuth2 when the redirect parameter is missing. Root cause: the respond middleware caches certain GET requests, and the condition...