Executive brief
Directus is a flexible headless CMS and backend platform used to manage databases and APIs. A vulnerability in its media upload feature allows authenticated users with basic privileges to scan internal networks and discover services, potentially revealing sensitive infrastructure details. An attacker could leverage this to map the internal network topology or probe for vulnerable services before launching more targeted attacks.
Technical details
The vulnerability is a server-side request forgery (CWE-918) in Directus's media upload functionality affecting versions 9.0.0-beta.2 through 9.6.0. A low-privileged authenticated user can craft requests during media upload that cause the server to make connections to arbitrary internal network addresses and ports. The attack requires valid user credentials but no additional user interaction. An attacker can perform reconnaissance on internal services by observing connection responses and timeouts, enabling network reconnaissance and potential exploitation of internal vulnerabilities. The fix, released in version 9.7.0, implements an IP deny list (IMPORT_IP_DENY_LIST configuration) to restrict connections to certain IP ranges, including localhost and private networks.
Affected products
- Directus Directus 9.0.0-beta.2 through 9.6.0
Timeline
- 2022-06-22: disclosed: Published by NVD
- 2022-06-23: disclosed: GitHub Advisory GHSA-5h75-pvq4-82c9 published
- 2022-03-07: patched: Fix commit 6da3f1ed applied (IMPORT_IP_DENY_LIST support)
- 9.7.0: other: Fix released in version 9.7.0