Executive brief
Directus is a headless CMS and data management platform used by developers to build content-driven applications. A cross-site scripting (XSS) vulnerability in the Rich Text HTML editor allows attackers to execute unauthorized JavaScript code by uploading malicious HTML and JavaScript files, then embedding them via iframes in the editor. This could lead to theft of user sessions, modification of content, or compromise of administrative accounts.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the Rich Text HTML WYSIWYG editor component. An attacker can insert an iframe element that references an uploaded HTML file, which in turn loads a malicious JavaScript file via a script tag. The existing Content Security Policy does not block this attack pattern because it permits iframes and script tags from uploaded files, allowing arbitrary JavaScript execution in the context of authenticated users' browsers. The vulnerability affects all versions before 9.7.0. A patch was released in version 9.7.0 (PR #12020), and administrators can temporarily mitigate the issue by disabling live embeds via the Rich Text HTML interface options.
Affected products
- Directus Directus < 9.7.0
Timeline
- 2022-04-04: disclosed
- 2022-04-05: patched: Version 9.7.0 released with fix (PR #12020)