Is CVE-2022-23080 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-23080 being exploited in the wild.

How severe is CVE-2022-23080?

Low severity, with a CVSS score of 3.1, published 23 June 2022.

Which products and versions are affected?

directus (npm) SEMVER:introduced=9.0.0-beta.2,fixed=9.7.0.

Is there a fix for CVE-2022-23080?

Yes. directus (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-23080 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2022-23080?

Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-23080: Directus server-side request forgery in media upload

CVE-2022-23080 · Severity: low · CVSS 3.1 · Published 2022-06-23

Directus is a flexible headless CMS and backend platform used to manage databases and APIs. A vulnerability in its media upload feature allows authenticated users with basic privileges to scan internal networks and discover services, potentially revealing sensitive infrastructure details. An attacker could leverage this to map the internal network topology or probe for vulnerable services before launching more targeted attacks.

Technologies: directus (npm). Vendors: npm.

Quick answers

Is CVE-2022-23080 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-23080 being exploited in the wild.
How severe is CVE-2022-23080?: Low severity, with a CVSS score of 3.1, published 23 June 2022.
Which products and versions are affected?: directus (npm) SEMVER:introduced=9.0.0-beta.2,fixed=9.7.0.
Is there a fix for CVE-2022-23080?: Yes. directus (npm): upgrade to 9.7.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-23080 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2022-23080?: Check whether you run directus (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

directus (npm): upgrade to 9.7.0 or later
```
npm install directus@9.7.0
```

Technical details

The vulnerability is a server-side request forgery (CWE-918) in Directus's media upload functionality affecting versions 9.0.0-beta.2 through 9.6.0. A low-privileged authenticated user can craft requests during media upload that cause the server to make connections to arbitrary internal network addresses and ports. The attack requires valid user credentials but no additional user interaction. An attacker can perform reconnaissance on internal services by observing connection responses and timeouts, enabling network reconnaissance and potential exploitation of internal vulnerabilities. The fix, released in version 9.7.0, implements an IP deny list (IMPORT_IP_DENY_LIST configuration) to restrict connections to certain IP ranges, including localhost and private networks.

Affected products

Directus Directus 9.0.0-beta.2 through 9.6.0

Identifiers

CVE-2022-23080
GHSA-5h75-pvq4-82c9

Timeline

2022-06-22: disclosed: Published by NVD
2022-06-23: disclosed: GitHub Advisory GHSA-5h75-pvq4-82c9 published
2022-03-07: patched: Fix commit 6da3f1ed applied (IMPORT_IP_DENY_LIST support)
9.7.0: other: Fix released in version 9.7.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.